Skip to content

[SYNCOPE-2009] Add new parameters for OIDC client apps: JWT access token signing algorithm, refresh token renewal, token expiration and audience #1607

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ilgrosso merged 6 commits into from
Nov 10, 2026
Merged

[SYNCOPE-2009] Add new parameters for OIDC client apps: JWT access token signing algorithm, refresh token renewal, token expiration and audience #1607

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
49a57ed
[SYNCOPE-2009] Add new parameters for OIDC services
mdisabatino Nov 9, 2026
8fb6f61
[SYNCOPE-2009] Fix checkstyle
mdisabatino Nov 9, 2026
f0d6375
[SYNCOPE-2009] Fix field
mdisabatino Nov 9, 2026
0c54c93
[SYNCOPE-2009] Fix field
mdisabatino Nov 9, 2026
d695073
[SYNCOPE-2009] Fix field
mdisabatino Nov 9, 2026
7a30823
[SYNCOPE-2009] fix import
mdisabatino Nov 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 27 additions & 1 deletion ...rc/main/java/org/apache/syncope/client/console/clientapps/ClientAppModalPanelBuilder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -374,6 +374,16 @@ protected void onUpdate(final AjaxRequestTarget target) {
fields.add(new AjaxTripleStateButtonPanel(
"field", "jwtAccessToken", new PropertyModel<>(clientAppTO, "jwtAccessToken")).
addRequiredLabel());

AjaxDropDownChoicePanel<OIDCTokenSigningAlg> jwtAccessTokenSigningAlg =
new AjaxDropDownChoicePanel<>(
"field", "jwtAccessTokenSigningAlg",
new PropertyModel<>(clientAppTO, "jwtAccessTokenSigningAlg"), false);

jwtAccessTokenSigningAlg.setChoices(Stream.of(OIDCTokenSigningAlg.values()).
filter(alg -> alg != OIDCTokenSigningAlg.none).toList());
fields.add(jwtAccessTokenSigningAlg);

fields.add(new AjaxTripleStateButtonPanel(
"field", "bypassApprovalPrompt", new PropertyModel<>(clientAppTO, "bypassApprovalPrompt")).
addRequiredLabel());
Expand Down Expand Up @@ -486,6 +496,9 @@ public void setObject(final String object) {
new PropertyModel<>(clientAppTO, "accessTokenMaxActiveTokens"));
fields.add(accessTokenMaxActiveTokens);

fields.add(new AjaxTripleStateButtonPanel(
"field", "renewRefreshToken", new PropertyModel<>(clientAppTO, "renewRefreshToken")));

AjaxTextFieldPanel refreshTokenTimeToKill = new AjaxTextFieldPanel(
"field", "refreshTokenTimeToKill",
new PropertyModel<>(clientAppTO, "refreshTokenTimeToKill"), false);
Expand All @@ -501,6 +514,19 @@ public void setObject(final String object) {
"field", "deviceTokenTimeToKill", new PropertyModel<>(clientAppTO, "deviceTokenTimeToKill"),
false);
fields.add(deviceTokenTimeToKill);

fields.add(new AjaxTextFieldPanel(
"field", "idTokenTimeToKill",
new PropertyModel<>(clientAppTO, "idTokenTimeToKill"), false));

fields.add(new AjaxTextFieldPanel(
"field", "authorizationCodeTimeToLive",
new PropertyModel<>(clientAppTO, "authorizationCodeTimeToLive"), false));

AjaxTextFieldPanel audience = new AjaxTextFieldPanel("panel", "audience", Model.of());
fields.add(new MultiFieldPanel.Builder<String>(
new PropertyModel<>(clientAppTO, "audience")).build(
"field", "audience", audience));
break;

case SAML2SP:
Expand Down Expand Up @@ -615,7 +641,7 @@ public String getObject() {
addRequiredLabel());

fields.add(new AjaxTripleStateButtonPanel(
"field", "skipGeneratingSubjectConfirmationAddress",
"field", "skipGeneratingSubjectConfirmationAddress",
new PropertyModel<>(clientAppTO, "skipGeneratingSubjectConfirmationAddress")).
addRequiredLabel());

Expand Down
56 changes: 56 additions & 0 deletions common/am/lib/src/main/java/org/apache/syncope/common/lib/to/OIDCRPClientAppTO.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,16 @@ public class OIDCRPClientAppTO extends ClientAppTO {

private String deviceTokenTimeToKill;

private OIDCTokenSigningAlg jwtAccessTokenSigningAlg;

private boolean renewRefreshToken;

private String idTokenTimeToKill;

private String authorizationCodeTimeToLive;

private final List<String> audience = new ArrayList<>();

private OIDCClientAuthenticationMethod tokenEndpointAuthenticationMethod =
OIDCClientAuthenticationMethod.client_secret_basic;

Expand Down Expand Up @@ -332,6 +342,42 @@ public void setDeviceTokenTimeToKill(final String deviceTokenTimeToKill) {
this.deviceTokenTimeToKill = deviceTokenTimeToKill;
}

public OIDCTokenSigningAlg getJwtAccessTokenSigningAlg() {
return jwtAccessTokenSigningAlg;
}

public void setJwtAccessTokenSigningAlg(final OIDCTokenSigningAlg jwtAccessTokenSigningAlg) {
this.jwtAccessTokenSigningAlg = jwtAccessTokenSigningAlg;
}

public boolean getRenewRefreshToken() {
return renewRefreshToken;
}

public void setRenewRefreshToken(final boolean renewRefreshToken) {
this.renewRefreshToken = renewRefreshToken;
}

public String getIdTokenTimeToKill() {
return idTokenTimeToKill;
}

public void setIdTokenTimeToKill(final String idTokenTimeToKill) {
this.idTokenTimeToKill = idTokenTimeToKill;
}

public String getAuthorizationCodeTimeToLive() {
return authorizationCodeTimeToLive;
}

public void setAuthorizationCodeTimeToLive(final String authorizationCodeTimeToLive) {
this.authorizationCodeTimeToLive = authorizationCodeTimeToLive;
}

public List<String> getAudience() {
Comment thread
ilgrosso marked this conversation as resolved.
Dismissed
return audience;
}

@Override
public boolean equals(final Object obj) {
if (obj == null) {
Expand Down Expand Up @@ -376,6 +422,11 @@ public boolean equals(final Object obj) {
.append(this.refreshTokenTimeToKill, rhs.accessTokenTimeToKill)
.append(this.refreshTokenMaxActiveTokens, rhs.refreshTokenMaxActiveTokens)
.append(this.deviceTokenTimeToKill, rhs.deviceTokenTimeToKill)
.append(this.jwtAccessTokenSigningAlg, rhs.jwtAccessTokenSigningAlg)
.append(this.renewRefreshToken, rhs.renewRefreshToken)
.append(this.idTokenTimeToKill, rhs.idTokenTimeToKill)
.append(this.authorizationCodeTimeToLive, rhs.authorizationCodeTimeToLive)
.append(this.audience, rhs.audience)
.isEquals();
}

Expand Down Expand Up @@ -413,6 +464,11 @@ public int hashCode() {
.append(refreshTokenTimeToKill)
.append(refreshTokenMaxActiveTokens)
.append(deviceTokenTimeToKill)
.append(jwtAccessTokenSigningAlg)
.append(renewRefreshToken)
.append(idTokenTimeToKill)
.append(authorizationCodeTimeToLive)
.append(audience)
.toHashCode();
}
}
18 changes: 18 additions & 0 deletions ...-api/src/main/java/org/apache/syncope/core/persistence/api/entity/am/OIDCRPClientApp.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,4 +141,22 @@ public interface OIDCRPClientApp extends ClientApp {
String getAccessTokenMaxTimeToLive();

void setAccessTokenMaxTimeToLive(String accessTokenMaxTimeToLive);

OIDCTokenSigningAlg getJwtAccessTokenSigningAlg();

void setJwtAccessTokenSigningAlg(OIDCTokenSigningAlg jwtAccessTokenSigningAlg);

boolean getRenewRefreshToken();

void setRenewRefreshToken(boolean renewRefreshToken);

String getIdTokenTimeToKill();

void setIdTokenTimeToKill(String idTokenTimeToKill);

String getAuthorizationCodeTimeToLive();

void setAuthorizationCodeTimeToLive(String authorizationCodeTimeToLive);

Set<String> getAudience();
}
65 changes: 65 additions & 0 deletions ...a/src/main/java/org/apache/syncope/core/persistence/jpa/entity/am/JPAOIDCRPClientApp.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,6 +154,21 @@ public class JPAOIDCRPClientApp extends AbstractClientApp implements OIDCRPClien

private String deviceTokenTimeToKill;

@Enumerated(EnumType.STRING)
private OIDCTokenSigningAlg jwtAccessTokenSigningAlg;

private boolean renewRefreshToken;

private String idTokenTimeToKill;

private String authorizationCodeTimeToLive;

@Lob
private String audience;

@Transient
private Set<String> audienceSet = new HashSet<>();

@Override
public Set<String> getRedirectUris() {
return redirectUrisSet;
Expand Down Expand Up @@ -436,11 +451,57 @@ public void setAccessTokenMaxTimeToLive(final String accessTokenMaxTimeToLive) {
this.accessTokenMaxTimeToLive = accessTokenMaxTimeToLive;
}

@Override
public OIDCTokenSigningAlg getJwtAccessTokenSigningAlg() {
return jwtAccessTokenSigningAlg;
}

@Override
public void setJwtAccessTokenSigningAlg(final OIDCTokenSigningAlg jwtAccessTokenSigningAlg) {
this.jwtAccessTokenSigningAlg = jwtAccessTokenSigningAlg;
}

@Override
public boolean getRenewRefreshToken() {
return renewRefreshToken;
}

@Override
public void setRenewRefreshToken(final boolean renewRefreshToken) {
this.renewRefreshToken = renewRefreshToken;
}

@Override
public String getIdTokenTimeToKill() {
return idTokenTimeToKill;
}

@Override
public void setIdTokenTimeToKill(final String idTokenTimeToKill) {
this.idTokenTimeToKill = idTokenTimeToKill;
}

@Override
public String getAuthorizationCodeTimeToLive() {
return authorizationCodeTimeToLive;
}

@Override
public void setAuthorizationCodeTimeToLive(final String authorizationCodeTimeToLive) {
this.authorizationCodeTimeToLive = authorizationCodeTimeToLive;
}

@Override
public Set<String> getAudience() {
return audienceSet;
}

protected void json2list(final boolean clearFirst) {
if (clearFirst) {
getRedirectUris().clear();
getSupportedGrantTypes().clear();
getSupportedResponseTypes().clear();
getAudience().clear();
}
if (redirectUris != null) {
getRedirectUris().addAll(POJOHelper.deserialize(redirectUris, STRING_TYPEREF));
Expand All @@ -454,6 +515,9 @@ protected void json2list(final boolean clearFirst) {
if (scopes != null) {
getScopes().addAll(POJOHelper.deserialize(scopes, SCOPE_TYPEREF));
}
if (audience != null) {
getAudience().addAll(POJOHelper.deserialize(audience, STRING_TYPEREF));
}
}

@PostLoad
Expand All @@ -474,5 +538,6 @@ public void list2json() {
supportedGrantTypes = POJOHelper.serialize(getSupportedGrantTypes());
supportedResponseTypes = POJOHelper.serialize(getSupportedResponseTypes());
scopes = POJOHelper.serialize(getScopes());
audience = POJOHelper.serialize(getAudience());
}
}
64 changes: 64 additions & 0 deletions ...c/main/java/org/apache/syncope/core/persistence/neo4j/entity/am/Neo4jOIDCRPClientApp.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,20 @@ public class Neo4jOIDCRPClientApp extends AbstractClientApp implements OIDCRPCli

private String deviceTokenTimeToKill;

private OIDCTokenSigningAlg jwtAccessTokenSigningAlg;

private boolean renewRefreshToken;

private String idTokenTimeToKill;

private String authorizationCodeTimeToLive;

private String audience;

@Transient
private Set<String> audienceSet = new HashSet<>();


@Override
public Set<String> getRedirectUris() {
return redirectUrisSet;
Expand Down Expand Up @@ -414,11 +428,57 @@ public void setAccessTokenMaxTimeToLive(final String accessTokenMaxTimeToLive) {
this.accessTokenMaxTimeToLive = accessTokenMaxTimeToLive;
}

@Override
public OIDCTokenSigningAlg getJwtAccessTokenSigningAlg() {
return jwtAccessTokenSigningAlg;
}

@Override
public void setJwtAccessTokenSigningAlg(final OIDCTokenSigningAlg jwtAccessTokenSigningAlg) {
this.jwtAccessTokenSigningAlg = jwtAccessTokenSigningAlg;
}

@Override
public boolean getRenewRefreshToken() {
return renewRefreshToken;
}

@Override
public void setRenewRefreshToken(final boolean renewRefreshToken) {
this.renewRefreshToken = renewRefreshToken;
}

@Override
public String getIdTokenTimeToKill() {
return idTokenTimeToKill;
}

@Override
public void setIdTokenTimeToKill(final String idTokenTimeToKill) {
this.idTokenTimeToKill = idTokenTimeToKill;
}

@Override
public String getAuthorizationCodeTimeToLive() {
return authorizationCodeTimeToLive;
}

@Override
public void setAuthorizationCodeTimeToLive(final String authorizationCodeTimeToLive) {
this.authorizationCodeTimeToLive = authorizationCodeTimeToLive;
}

@Override
public Set<String> getAudience() {
return audienceSet;
}

protected void json2list(final boolean clearFirst) {
if (clearFirst) {
getRedirectUris().clear();
getSupportedGrantTypes().clear();
getSupportedResponseTypes().clear();
getAudience().clear();
}
if (redirectUris != null) {
getRedirectUris().addAll(POJOHelper.deserialize(redirectUris, STRING_TYPEREF));
Expand All @@ -432,6 +492,9 @@ protected void json2list(final boolean clearFirst) {
if (scopes != null) {
getScopes().addAll(POJOHelper.deserialize(scopes, SCOPE_TYPEREF));
}
if (audience != null) {
getAudience().addAll(POJOHelper.deserialize(audience, STRING_TYPEREF));
}
}

@PostLoad
Expand All @@ -448,5 +511,6 @@ public void list2json() {
supportedGrantTypes = POJOHelper.serialize(getSupportedGrantTypes());
supportedResponseTypes = POJOHelper.serialize(getSupportedResponseTypes());
scopes = POJOHelper.serialize(getScopes());
audience = POJOHelper.serialize(getAudience());
}
}
11 changes: 11 additions & 0 deletions ...src/main/java/org/apache/syncope/core/provisioning/java/data/ClientAppDataBinderImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -328,6 +328,12 @@ protected void doUpdate(final OIDCRPClientApp clientApp, final OIDCRPClientAppTO
clientApp.setRefreshTokenMaxActiveTokens(clientAppTO.getRefreshTokenMaxActiveTokens());
clientApp.setRefreshTokenTimeToKill(clientAppTO.getRefreshTokenTimeToKill());
clientApp.setDeviceTokenTimeToKill(clientAppTO.getDeviceTokenTimeToKill());
clientApp.setJwtAccessTokenSigningAlg(clientAppTO.getJwtAccessTokenSigningAlg());
clientApp.setRenewRefreshToken(clientAppTO.getRenewRefreshToken());
clientApp.setIdTokenTimeToKill(clientAppTO.getIdTokenTimeToKill());
clientApp.setAuthorizationCodeTimeToLive(clientAppTO.getAuthorizationCodeTimeToLive());
clientApp.getAudience().clear();
clientApp.getAudience().addAll(clientAppTO.getAudience());

Set<String> allowedScopes = new HashSet<>();
Stream.of(OIDCStandardScope.values()).map(OIDCStandardScope::name).forEach(allowedScopes::add);
Expand Down Expand Up @@ -379,6 +385,11 @@ protected OIDCRPClientAppTO getOIDCClientAppTO(final OIDCRPClientApp clientApp)
clientAppTO.setRefreshTokenTimeToKill(clientApp.getRefreshTokenTimeToKill());
clientAppTO.setRefreshTokenMaxActiveTokens(clientApp.getRefreshTokenMaxActiveTokens());
clientAppTO.setDeviceTokenTimeToKill(clientApp.getDeviceTokenTimeToKill());
clientAppTO.setJwtAccessTokenSigningAlg(clientApp.getJwtAccessTokenSigningAlg());
clientAppTO.setRenewRefreshToken(clientApp.getRenewRefreshToken());
clientAppTO.setIdTokenTimeToKill(clientApp.getIdTokenTimeToKill());
clientAppTO.setAuthorizationCodeTimeToLive(clientApp.getAuthorizationCodeTimeToLive());
clientAppTO.getAudience().addAll(clientApp.getAudience());
return clientAppTO;
}

Expand Down
4 changes: 4 additions & 0 deletions fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -979,6 +979,10 @@ protected static OIDCRPClientAppTO buildOIDCRP() {
oidcrpTO.setRefreshTokenTimeToKill("P14D");
oidcrpTO.setDeviceTokenTimeToKill("PT5M");

oidcrpTO.setRenewRefreshToken(true);
oidcrpTO.setIdTokenTimeToKill("PT5M");
oidcrpTO.setAuthorizationCodeTimeToLive("PT30S");
oidcrpTO.getAudience().add("https://api.apache.org");
return oidcrpTO;
}

Expand Down
Loading
Loading