commit 259747e1a94a52b91fd2ab6ff0760d1b3f872f75
author Alexey Markevich <buhhunyx@gmail.com> Wed Feb 26 14:10:13 2020 +0300
committer Colm O hEigeartaigh <coheigea@apache.org> Wed Feb 26 15:45:00 2020 +0000
tree 0a493f7f457e1373deb7718aa5083337774e2cb5
parent 3278d63428435f3ed0303d32bc7bbfd8e23afe12

fediz-oidc: fix exp claim when timeToLive specified

services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/FedizSubjectCreator.java

diff --git a/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/FedizSubjectCreator.java b/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/FedizSubjectCreator.java
index 3a9e6e5..9488a0f 100644
--- a/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/FedizSubjectCreator.java
+++ b/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/FedizSubjectCreator.java
@@ -137,15 +137,15 @@
         idToken.setTokenId(OAuthUtils.generateRandomTokenKey());
 
         // Compute exp claim
-        long currentTimeInSecs = System.currentTimeMillis() / 1000L;
-        idToken.setIssuedAt(currentTimeInSecs);
+        final long iat = OAuthUtils.getIssuedAt();
+        idToken.setIssuedAt(iat);
         HttpSession httpSession = mc.getHttpServletRequest().getSession(false);
         if (timeToLive > 0) {
-            idToken.setExpiryTime(timeToLive);
+            idToken.setExpiryTime(iat + timeToLive);
         } else if (httpSession != null && httpSession.getMaxInactiveInterval() > 0) {
-            idToken.setExpiryTime(currentTimeInSecs + httpSession.getMaxInactiveInterval());
+            idToken.setExpiryTime(iat + httpSession.getMaxInactiveInterval());
         } else {
-            idToken.setExpiryTime(currentTimeInSecs + DEFAULT_TIME_TO_LIVE);
+            idToken.setExpiryTime(iat + DEFAULT_TIME_TO_LIVE);
         }
 
         List<String> requestedClaimsList = new ArrayList<String>();