Odtnhj

I have been fiddling around with IDS 4 and I have a small problem. I set my token life times to about 15 seconds and even though they are expired I can still retrieve date from my resource server. If I remove the token from my header on the client call I get a 401 error.

Client

 [Authorize]
 public async Task<ActionResult> Shouts()
 

 var accessToken = await HttpContext.GetTokenAsync("access_token");
 var tokenh = new JwtSecurityTokenHandler();

 var jwtSecurityToken= tokenh.ReadJwtToken(accessToken);

 var val = jwtSecurityToken.ValidTo;



 using (var client = new HttpClient())
 

 client.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", accessToken);
 var rawResponse = await client.GetAsync("http://localhost:5002/api/Values/Get");

 if (rawResponse.StatusCode == System.Net.HttpStatusCode.Unauthorized)
 
 var refreshSucc = await this.RefreshTokensAsync(this.HttpContext);
 if (!refreshSucc)
 
 var authServerInfo = await this.GetAuthenticationServerInfo();
 return Redirect(authServerInfo.AuthorizeEndpoint);
 
 

 var response = await (rawResponse).Content.ReadAsStringAsync();
 var data = JsonConvert.DeserializeObject<List<String>>(response);
 return View("Shouts", data);
 
 
 public class Startup
 
 public Startup(IConfiguration configuration)
 
 Configuration = configuration;
 

 public IConfiguration Configuration get; 

 // This method gets called by the runtime. Use this method to add services to the container.
 public void ConfigureServices(IServiceCollection services)
 

 JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
 services.AddAuthentication(options =>
 
 options.DefaultScheme = "Cookies";
 options.DefaultChallengeScheme = "oidc"; 
 )
 .AddCookie("Cookies",o=>o.LogoutPath="/home/logout")
 .AddOpenIdConnect("oidc", opt => 
 
 opt.SignInScheme = "Cookies";
 opt.Authority = "http://localhost:5000";
 opt.RequireHttpsMetadata = false;
 opt.ClientId = "AuthTest_Code";
 opt.ClientSecret = "secret";
 opt.ResponseType = "id_token code";
 opt.Scope.Add("TestAPI");
 opt.Scope.Add("offline_access");
 opt.Scope.Add("email");
 opt.GetClaimsFromUserInfoEndpoint = true;
 opt.SaveTokens = true; 
 );
 services.AddMvc();
 

 // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
 public void Configure(IApplicationBuilder app, IHostingEnvironment env)
 
 if (env.IsDevelopment())
 
 app.UseBrowserLink();
 app.UseDeveloperExceptionPage();
 
 else
 
 app.UseExceptionHandler("/Home/Error");
 

 app.UseStaticFiles();

 app.UseAuthentication();

 app.UseMvc(routes =>
 
 routes.MapRoute(
 name: "default",
 template: "controller=Home/action=Index/id?");
 );
 
 

Auth Server

 public static IEnumerable<Client> GetClients()
 
 return new List<Client>
 
 new Client
 
 ClientId = "AuthTest_Code",
 ClientSecrets=new new Secret("secret".Sha256()) ,
 AllowedGrantTypes = GrantTypes.Hybrid,
 AllowedScopes = new List<string>
 
 IdentityServerConstants.StandardScopes.OpenId,
 IdentityServerConstants.StandardScopes.Profile,
 IdentityServerConstants.StandardScopes.Email, 
 "TestAPI"
 ,
 AllowAccessTokensViaBrowser=true,
 AllowOfflineAccess=true,
 RedirectUris = new "http://localhost:5001/signin-oidc" ,
 PostLogoutRedirectUris= "http://localhost:5001/signout-callback-odic",
 RequireConsent=false,
 AccessTokenLifetime=15,
 AbsoluteRefreshTokenLifetime=15
 
 ;
 

public class Startup

 public IHostingEnvironment Environment get; 

 public Startup(IHostingEnvironment environment)
 
 Environment = environment;
 
 // This method gets called by the runtime. Use this method to add services to the container.
 // For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=398940
 public void ConfigureServices(IServiceCollection services)
 
 var isServer = services.AddIdentityServer() 
 .AddSigningCredential(new X509Certificate2(@"C:OpenSSLCertsAuthenticate.pfx", "Password1"))
 .AddInMemoryApiResources(TestConfig.GetApis())
 .AddInMemoryClients(TestConfig.GetClients())
 .AddInMemoryIdentityResources(TestConfig.GetIdentityResources())
 .AddTestUsers(TestConfig.GetUsers());


 services.AddMvc();
 

 // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
 public void Configure(IApplicationBuilder app, IHostingEnvironment env)
 
 if (Environment.IsDevelopment())
 
 app.UseDeveloperExceptionPage();
 

 app.UseIdentityServer();

 app.UseStaticFiles();

 app.UseMvcWithDefaultRoute();
 

Resource Server

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.DependencyInjection;

namespace ResourceAPI

 public class Startup
 
 // This method gets called by the runtime. Use this method to add services to the container.
 // For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=398940
 public void ConfigureServices(IServiceCollection services)
 
 services.AddMvcCore()
 .AddAuthorization()
 .AddJsonFormatters();

 services.AddAuthentication("Bearer") 
 .AddIdentityServerAuthentication(options =>
 
 options.Authority = "http://localhost:5000";
 options.RequireHttpsMetadata = false; 
 options.ApiName = "TestAPI"; 
 );
 

 // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
 public void Configure(IApplicationBuilder app, IHostingEnvironment env)
 
 app.UseAuthentication();
 app.UseMvc();
 
 



 [Route("api/[controller]")]
 public class ValuesController:ControllerBase
 
 [HttpGet]
 [Route("Get")]
 [Authorize]
 public async Task<IActionResult> Get()
 
 var username = User.Claims.FirstOrDefault(t => t.Type == "email")?.Value;
 return Ok(new string "value1", "value2" );
 
 

Access Token:
eyJhbGciOiJSUzI1NiIsImtpZCI6IjQ0Q0Q4NjFEQjA0MzdEMUM4NUY2REU0MTIyMkFDOEIwMTE3M0Q2MTAiLCJ0eXAiOiJKV1QiLCJ4NXQiOiJSTTJHSGJCRGZSeUY5dDVCSWlySXNCRnoxaEEifQ.eyJuYmYiOjE1NDIxMjc4OTQsImV4cCI6MTU0MjEyNzkwOSwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwIiwiYXVkIjpbImh0dHA6Ly9sb2NhbGhvc3Q6NTAwMC9yZXNvdXJjZXMiLCJUZXN0QVBJIl0sImNsaWVudF9pZCI6IkF1dGhUZXN0X0NvZGUiLCJzdWIiOiIxIiwiYXV0aF90aW1lIjoxNTQyMTI3ODkzLCJpZHAiOiJsb2NhbCIsImVtYWlsIjoiRGF2aWRAQUJldHRlckxpZmUuY28uemEiLCJzY29wZSI6WyJvcGVuaWQiLCJwcm9maWxlIiwiZW1haWwiLCJUZXN0QVBJIiwib2ZmbGluZV9hY2Nlc3MiXSwiYW1yIjpbInB3ZCJdfQ.hNskjZz3IBqPg_5T0xVwYEP5RukcMt3l019PRp74vNBkiEr6FLvBADa_eylhNGA8qDd7SwyDkq6APaKxaNt0YybAChZvFW6pzLlfknVVHM1vuN7PDOX9PNGhFK9kSONBypXo6JqV3epactsmJvhr3FZxBSufUDRyV4j_YY3O8TCjJf_5UORc_3ox9clNdjt-Vx-BlcDjVbpBw2P76F3pq2IPPDM139H4qYcyaTzSlEbFd3EdVwO6O85bWM1G8yQ9zQAUk23It29oHxTtwsi5Wg4Zpmt7K7AlvKjKxKoxw_Y32QdBkGY9xU_KXOn4h0WJV3LG-InZc7BveLGHq6ncaQ

Try setting options.JwtValidationClockSkew property to zero in your web api(resource server)

 services.AddAuthentication("Bearer")
 .AddIdentityServerAuthentication(options =>
 
 options.JwtValidationClockSkew = TimeSpan.Zero;
 options.Authority = "https://localhost:44323";
 options.RequireHttpsMetadata = false;

 options.ApiName = "api1";
 );

There is a clock skew in the Microsoft JWT validation middleware. It is set by default to 5 mins. And it's suggest to leave it as default (300 seconds/5 minutes).

This is most likely due to the default 5 minute (if memory serves) clock skew allowance. It is however possible to override this setting in IDS4 and the bearer token middleware.