How to set expire_in in OAUTH 2.0?

Question

I am using OAuth 2.0 with spring for token generation and I want to set expire_in manually so token can expire as per my criteria. Any one help me?

Answer 1

public interface OAuth2AccessToken {

    public static String BEARER_TYPE = "Bearer";

    public static String OAUTH2_TYPE = "OAuth2";

    /**
     * The access token issued by the authorization server. This value is REQUIRED.
     */
    public static String ACCESS_TOKEN = "access_token";

    /**
     * The type of the token issued as described in <a
     * href="http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-7.1">Section 7.1</a>. Value is case insensitive.
     * This value is REQUIRED.
     */
    public static String TOKEN_TYPE = "token_type";

    /**
     * The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will
     * expire in one hour from the time the response was generated. This value is OPTIONAL.
     */
    public static String EXPIRES_IN = "expires_in";

    /**
     * The refresh token which can be used to obtain new access tokens using the same authorization grant as described
     * in <a href="http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-6">Section 6</a>. This value is OPTIONAL.
     */
    public static String REFRESH_TOKEN = "refresh_token";

    /**
     * The scope of the access token as described by <a
     * href="http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-3.3">Section 3.3</a>
     */
    public static String SCOPE = "scope";

    /**
     * The additionalInformation map is used by the token serializers to export any fields used by extensions of OAuth.
     * @return a map from the field name in the serialized token to the value to be exported. The default serializers 
     * make use of Jackson's automatic JSON mapping for Java objects (for the Token Endpoint flows) or implicitly call 
     * .toString() on the "value" object (for the implicit flow) as part of the serialization process.
     */
    Map<String, Object> getAdditionalInformation();

    Set<String> getScope();

    OAuth2RefreshToken getRefreshToken();

    String getTokenType();

    boolean isExpired();

    Date getExpiration();

    int getExpiresIn();

    String getValue();

}

Answer 2

You can also configure the DefaultTokenServices in the application.yaml file.

security:
  oauth2:
    client:
      clientId: client-id
      clientSecret: client-secret
      authorized-grant-types: authorization_code,refresh_token,password
      scope: openid
      access-token-validity-seconds: 30

Answer 3

As such I don't think there is any policy to do that so. But there is one way which can lead to success. Just use refresh_token API to make the current access_token invalid. :D Simple is that.

Answer 4

Also was searching for this answer and tried proposed solution from DeezCashews. But it didn't work for me, because there is a part of code which firstly check if this value is set in in column access_token_validity table oauth_client_details and only then greps value from tokenServices. So if your "expires_in" is set in oauth_client_details table, then you need to change it there.

Code which checks validity property in db :

    protected int getAccessTokenValiditySeconds(OAuth2Request clientAuth) {
    if (clientDetailsService != null) {
        ClientDetails client = clientDetailsService.loadClientByClientId(clientAuth.getClientId());
        Integer validity = client.getAccessTokenValiditySeconds();
        if (validity != null) {
            return validity;
        }
    }
    return accessTokenValiditySeconds;
}

Answer 5

• Create a custom class of AuthorizationCodeAccessTokenProvider and override the parent

  public method obtainAccessToken(OAuth2ProtectedResourceDetails details, AccessTokenRequest request)
  

• In the overridden method of your custom class, call upon the program logic of its parent class:

  DefaultOAuth2AccessToken token = super.obtainAccessToken(details, request);
  

• This will return an AccessToken. Now, you just have to manipulate the expired value of that token directly, by providing a timestamp from the past token.setExpiresIn(int timestamp)

Answer 6

If you are using grails security oauth2 provider you can only change grails-app/conf/spring/resources.groovy

import org.springframework.security.oauth2.provider.token.DefaultTokenServices

// Place your Spring DSL code here    

beans = {

  tokenServices(DefaultTokenServices){
    accessTokenValiditySeconds =  600;
    tokenStore = ref('tokenStore')
    supportRefreshToken = true;
    clientDetailsService = ref('clientDetailsService')
  }

}