coheigea opened a new pull request, #3696: URL: https://github.com/apache/cxf/pull/3696
he SAML SSO and OAuth 2.0 SAML bearer replay checks cache an assertion's ID until the assertion expires. But a replay cache only holds an ID for so long: 12 hours with the default Ehcache and JCache configurations. So an assertion valid for longer could be accepted again once its ID had expired from the cache. Add TokenReplayCache.getMaxTTL(), a default method that returns null (unknown), so existing implementations are unaffected. It returns 12 hours for EHCacheTokenReplayCache if its cache uses EHCacheExpiry (as the default configuration does), and for JCacheTokenReplayCache with the default configuration. SAMLSSOResponseValidator and SamlOAuthValidator now reject an assertion that is valid for longer than this, unless setAllowAssertionsBeyondReplayCacheTTL(true) is set (it is also exposed on AbstractRequestAssertionConsumerHandler, which creates the SSO validator). If the JCache provider does not define the JCacheTokenReplayCache cache (for example, a provider other than Ehcache, which cannot read the default configuration), it was created with no expiry at all, so it grew without bound. It is now created with a fixed TTL of 12 hours. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
