feat: custom client token ttl

This change introduces a new endpoint that allows you to control how long client tokens last. Now you can configure the lifespan for each valid combination of Client, GrantType, and TokenType. Part of #3157
ory · Jul 28, 2022 · 3e959c0 · 3e959c0
1 parent 2a4ad74
commit 3e959c0
Show file tree

Hide file tree

Showing 40 changed files with 1,862 additions and 58 deletions.
diff --git a/...dler-common-case=create_clients-case=0-description=basic_dynamic_client_registration.json b/...dler-common-case=create_clients-case=0-description=basic_dynamic_client_registration.json
@@ -19,5 +19,17 @@
   "jwks": {},
   "token_endpoint_auth_method": "client_secret_basic",
   "userinfo_signed_response_alg": "none",
-  "metadata": {}
+  "metadata": {},
+  "authorization_code_grant_access_token_lifespan": null,
+  "authorization_code_grant_id_token_lifespan": null,
+  "authorization_code_grant_refresh_token_lifespan": null,
+  "client_credentials_grant_access_token_lifespan": null,
+  "implicit_grant_access_token_lifespan": null,
+  "implicit_grant_id_token_lifespan": null,
+  "jwt_bearer_grant_access_token_lifespan": null,
+  "password_grant_access_token_lifespan": null,
+  "password_grant_refresh_token_lifespan": null,
+  "refresh_token_grant_id_token_lifespan": null,
+  "refresh_token_grant_access_token_lifespan": null,
+  "refresh_token_grant_refresh_token_lifespan": null
 }
diff --git a/...s/TestHandler-common-case=create_clients-case=1-description=basic_admin_registration.json b/...s/TestHandler-common-case=create_clients-case=1-description=basic_admin_registration.json
@@ -24,5 +24,17 @@
   "metadata": {
     "foo": "bar"
   },
-  "registration_client_uri": "http://localhost:4444/oauth2/register/create-client-2"
+  "registration_client_uri": "http://localhost:4444/oauth2/register/create-client-2",
+  "authorization_code_grant_access_token_lifespan": null,
+  "authorization_code_grant_id_token_lifespan": null,
+  "authorization_code_grant_refresh_token_lifespan": null,
+  "client_credentials_grant_access_token_lifespan": null,
+  "implicit_grant_access_token_lifespan": null,
+  "implicit_grant_id_token_lifespan": null,
+  "jwt_bearer_grant_access_token_lifespan": null,
+  "password_grant_access_token_lifespan": null,
+  "password_grant_refresh_token_lifespan": null,
+  "refresh_token_grant_id_token_lifespan": null,
+  "refresh_token_grant_access_token_lifespan": null,
+  "refresh_token_grant_refresh_token_lifespan": null
 }
diff --git a/client/.snapshots/TestHandler-common-case=fetching_existing_client-endpoint=admin.json b/client/.snapshots/TestHandler-common-case=fetching_existing_client-endpoint=admin.json
@@ -21,7 +21,19 @@
     "jwks": {},
     "token_endpoint_auth_method": "client_secret_basic",
     "userinfo_signed_response_alg": "none",
-    "metadata": {}
+    "metadata": {},
+    "authorization_code_grant_access_token_lifespan": null,
+    "authorization_code_grant_id_token_lifespan": null,
+    "authorization_code_grant_refresh_token_lifespan": null,
+    "client_credentials_grant_access_token_lifespan": null,
+    "implicit_grant_access_token_lifespan": null,
+    "implicit_grant_id_token_lifespan": null,
+    "jwt_bearer_grant_access_token_lifespan": null,
+    "password_grant_access_token_lifespan": null,
+    "password_grant_refresh_token_lifespan": null,
+    "refresh_token_grant_id_token_lifespan": null,
+    "refresh_token_grant_access_token_lifespan": null,
+    "refresh_token_grant_refresh_token_lifespan": null
   },
   "status": 200
 }
diff --git a/client/.snapshots/TestHandler-common-case=fetching_existing_client-endpoint=selfservice.json b/client/.snapshots/TestHandler-common-case=fetching_existing_client-endpoint=selfservice.json
@@ -20,7 +20,19 @@
     "subject_type": "public",
     "jwks": {},
     "token_endpoint_auth_method": "client_secret_basic",
-    "userinfo_signed_response_alg": "none"
+    "userinfo_signed_response_alg": "none",
+    "authorization_code_grant_access_token_lifespan": null,
+    "authorization_code_grant_id_token_lifespan": null,
+    "authorization_code_grant_refresh_token_lifespan": null,
+    "client_credentials_grant_access_token_lifespan": null,
+    "implicit_grant_access_token_lifespan": null,
+    "implicit_grant_id_token_lifespan": null,
+    "jwt_bearer_grant_access_token_lifespan": null,
+    "password_grant_access_token_lifespan": null,
+    "password_grant_refresh_token_lifespan": null,
+    "refresh_token_grant_id_token_lifespan": null,
+    "refresh_token_grant_access_token_lifespan": null,
+    "refresh_token_grant_refresh_token_lifespan": null
   },
   "status": 200
 }
diff --git a/client/.snapshots/TestHandler-common-case=updating_existing_client-endpoint=admin.json b/client/.snapshots/TestHandler-common-case=updating_existing_client-endpoint=admin.json
@@ -23,7 +23,19 @@
     "jwks": {},
     "token_endpoint_auth_method": "client_secret_basic",
     "userinfo_signed_response_alg": "none",
-    "metadata": {}
+    "metadata": {},
+    "authorization_code_grant_access_token_lifespan": null,
+    "authorization_code_grant_id_token_lifespan": null,
+    "authorization_code_grant_refresh_token_lifespan": null,
+    "client_credentials_grant_access_token_lifespan": null,
+    "implicit_grant_access_token_lifespan": null,
+    "implicit_grant_id_token_lifespan": null,
+    "jwt_bearer_grant_access_token_lifespan": null,
+    "password_grant_access_token_lifespan": null,
+    "password_grant_refresh_token_lifespan": null,
+    "refresh_token_grant_id_token_lifespan": null,
+    "refresh_token_grant_access_token_lifespan": null,
+    "refresh_token_grant_refresh_token_lifespan": null
   },
   "status": 200
 }
diff --git a/...estHandler-common-case=updating_existing_client-endpoint=dynamic_client_registration.json b/...estHandler-common-case=updating_existing_client-endpoint=dynamic_client_registration.json
@@ -22,7 +22,19 @@
     "jwks": {},
     "token_endpoint_auth_method": "client_secret_basic",
     "userinfo_signed_response_alg": "none",
-    "metadata": {}
+    "metadata": {},
+    "authorization_code_grant_access_token_lifespan": null,
+    "authorization_code_grant_id_token_lifespan": null,
+    "authorization_code_grant_refresh_token_lifespan": null,
+    "client_credentials_grant_access_token_lifespan": null,
+    "implicit_grant_access_token_lifespan": null,
+    "implicit_grant_id_token_lifespan": null,
+    "jwt_bearer_grant_access_token_lifespan": null,
+    "password_grant_access_token_lifespan": null,
+    "password_grant_refresh_token_lifespan": null,
+    "refresh_token_grant_id_token_lifespan": null,
+    "refresh_token_grant_access_token_lifespan": null,
+    "refresh_token_grant_refresh_token_lifespan": null
   },
   "status": 200
 }
diff --git a/client/.snapshots/TestHandler-create_client_registration_tokens-case=0-dynamic=false.json b/client/.snapshots/TestHandler-create_client_registration_tokens-case=0-dynamic=false.json
@@ -17,5 +17,17 @@
   "subject_type": "",
   "jwks": {},
   "metadata": {},
-  "registration_client_uri": "http://localhost:4444/oauth2/register/create-client-0"
+  "registration_client_uri": "http://localhost:4444/oauth2/register/create-client-0",
+  "authorization_code_grant_access_token_lifespan": null,
+  "authorization_code_grant_id_token_lifespan": null,
+  "authorization_code_grant_refresh_token_lifespan": null,
+  "client_credentials_grant_access_token_lifespan": null,
+  "implicit_grant_access_token_lifespan": null,
+  "implicit_grant_id_token_lifespan": null,
+  "jwt_bearer_grant_access_token_lifespan": null,
+  "password_grant_access_token_lifespan": null,
+  "password_grant_refresh_token_lifespan": null,
+  "refresh_token_grant_id_token_lifespan": null,
+  "refresh_token_grant_access_token_lifespan": null,
+  "refresh_token_grant_refresh_token_lifespan": null
 }
diff --git a/client/.snapshots/TestHandler-create_client_registration_tokens-case=1-dynamic=true.json b/client/.snapshots/TestHandler-create_client_registration_tokens-case=1-dynamic=true.json
@@ -15,5 +15,17 @@
   "client_secret_expires_at": 0,
   "subject_type": "",
   "jwks": {},
-  "metadata": {}
+  "metadata": {},
+  "authorization_code_grant_access_token_lifespan": null,
+  "authorization_code_grant_id_token_lifespan": null,
+  "authorization_code_grant_refresh_token_lifespan": null,
+  "client_credentials_grant_access_token_lifespan": null,
+  "implicit_grant_access_token_lifespan": null,
+  "implicit_grant_id_token_lifespan": null,
+  "jwt_bearer_grant_access_token_lifespan": null,
+  "password_grant_access_token_lifespan": null,
+  "password_grant_refresh_token_lifespan": null,
+  "refresh_token_grant_id_token_lifespan": null,
+  "refresh_token_grant_access_token_lifespan": null,
+  "refresh_token_grant_refresh_token_lifespan": null
 }
diff --git a/client/.snapshots/TestHandler-create_client_registration_tokens-case=2-dynamic=false.json b/client/.snapshots/TestHandler-create_client_registration_tokens-case=2-dynamic=false.json
@@ -17,5 +17,17 @@
   "subject_type": "",
   "jwks": {},
   "metadata": {},
-  "registration_client_uri": "http://localhost:4444/oauth2/register/create-client-1"
+  "registration_client_uri": "http://localhost:4444/oauth2/register/create-client-1",
+  "authorization_code_grant_access_token_lifespan": null,
+  "authorization_code_grant_id_token_lifespan": null,
+  "authorization_code_grant_refresh_token_lifespan": null,
+  "client_credentials_grant_access_token_lifespan": null,
+  "implicit_grant_access_token_lifespan": null,
+  "implicit_grant_id_token_lifespan": null,
+  "jwt_bearer_grant_access_token_lifespan": null,
+  "password_grant_access_token_lifespan": null,
+  "password_grant_refresh_token_lifespan": null,
+  "refresh_token_grant_id_token_lifespan": null,
+  "refresh_token_grant_access_token_lifespan": null,
+  "refresh_token_grant_refresh_token_lifespan": null
 }
diff --git a/client/.snapshots/TestHandler-create_client_registration_tokens-case=3-dynamic=false.json b/client/.snapshots/TestHandler-create_client_registration_tokens-case=3-dynamic=false.json
@@ -18,5 +18,17 @@
   "subject_type": "",
   "jwks": {},
   "metadata": {},
-  "registration_client_uri": "http://localhost:4444/oauth2/register/"
+  "registration_client_uri": "http://localhost:4444/oauth2/register/",
+  "authorization_code_grant_access_token_lifespan": null,
+  "authorization_code_grant_id_token_lifespan": null,
+  "authorization_code_grant_refresh_token_lifespan": null,
+  "client_credentials_grant_access_token_lifespan": null,
+  "implicit_grant_access_token_lifespan": null,
+  "implicit_grant_id_token_lifespan": null,
+  "jwt_bearer_grant_access_token_lifespan": null,
+  "password_grant_access_token_lifespan": null,
+  "password_grant_refresh_token_lifespan": null,
+  "refresh_token_grant_id_token_lifespan": null,
+  "refresh_token_grant_access_token_lifespan": null,
+  "refresh_token_grant_refresh_token_lifespan": null
 }
diff --git a/client/.snapshots/TestHandler-create_client_registration_tokens-case=4-dynamic=true.json b/client/.snapshots/TestHandler-create_client_registration_tokens-case=4-dynamic=true.json
@@ -15,5 +15,17 @@
   "client_secret_expires_at": 0,
   "subject_type": "",
   "jwks": {},
-  "metadata": {}
+  "metadata": {},
+  "authorization_code_grant_access_token_lifespan": null,
+  "authorization_code_grant_id_token_lifespan": null,
+  "authorization_code_grant_refresh_token_lifespan": null,
+  "client_credentials_grant_access_token_lifespan": null,
+  "implicit_grant_access_token_lifespan": null,
+  "implicit_grant_id_token_lifespan": null,
+  "jwt_bearer_grant_access_token_lifespan": null,
+  "password_grant_access_token_lifespan": null,
+  "password_grant_refresh_token_lifespan": null,
+  "refresh_token_grant_id_token_lifespan": null,
+  "refresh_token_grant_access_token_lifespan": null,
+  "refresh_token_grant_refresh_token_lifespan": null
 }