Mailing-List: contact issues-help@cxf.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cxf.apache.org
Date: Thu, 24 Sep 2015 13:25:04 +0000 (UTC)
From: "Colm O hEigeartaigh (JIRA)" <jira@apache.org>
To: issues@cxf.apache.org
Message-ID: <JIRA.12895944.1443049218000.62303.1443101104632@Atlassian.JIRA>
In-Reply-To: <JIRA.12895944.1443049218000@Atlassian.JIRA>
References: <JIRA.12895944.1443049218000@Atlassian.JIRA>
 <JIRA.12895944.1443049218867@arcas>
Subject: [jira] [Assigned] (CXF-6607) Cached STS-issued tokens are not
 renewed on expiry in delegation scenario
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


     [ https://issues.apache.org/jira/browse/CXF-6607?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Colm O hEigeartaigh reassigned CXF-6607:
----------------------------------------

    Assignee: Colm O hEigeartaigh

> Cached STS-issued tokens are not renewed on expiry in delegation scenario
> -------------------------------------------------------------------------
>
>                 Key: CXF-6607
>                 URL: https://issues.apache.org/jira/browse/CXF-6607
>             Project: CXF
>          Issue Type: Bug
>          Components: STS
>            Reporter: Andreas Vallen
>            Assignee: Colm O hEigeartaigh
>
> Setting ws-security.cache.issued.token.in.endpoint" to "false" is the recommended setting for a delegation scenario, where a webapp acts as an intermediary that requests tokens for a webserivce on behalf of a WS-Federation SAML token.
> When this setting is effective however, we observe that tokens that have been issued for use by the intermediary are not renewed on expiry.
> The following code in {{IssuedTokenInterceptorProvider}} may be the starting point of this misbehaviour:
> {code}
>                     SecurityToken tok = retrieveCachedToken(message);
>                     if (tok == null) {
>                         tok = issueToken(message, aim, itok);
>                     } else {
>                         tok = renewToken(message, aim, itok, tok);
>                     }
> {code}
> With the above property set to false the issued token is cached in a different way than expected by {{retrieveCachedToken}}, leading to the bypass of the token renewal.
> Instead the token is cached indirectly via the actAs or onBehalfOf token where it is retrieved from by the #handleDelegation method of the same Interceptor.


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)