Question: slack_before vs. token expiry

[DrakezulsMinimalism]

Hi Mr. Zandbelt and community,

I am migrating from mod_auth_openidc to (additionally) mod_oauth2.
For token validation, I needed to specify the "verify.slack_before" parameter, but have a question about it:
If a token is issued at 15:00 and has an expiry at 16:00 (valid 1h), then the "verify.slack_before" has to be set to 1h, is that correct?
Is this just an additional "constraint" on the token, complementing the tokens "expiry" date, or have I got it wrong?

I issued a token in Postman at 14:30, set the slack_before to 450s (7.5minuts) and used it at 14:31 => works
I used the same token at 14:38 and it fails

"iat" validation failure (%milliseconds-here%): JWT was issued more than 450 seconds ago.

Now, the documentation and logic is consistent, but I do not quite understand the setting (which has a default value of 10 seconds, making a token only valid (to mod_oauth2) for 10 seconds after issuance)?

And slack_after is to deal with "clock drift" if the issuing server has a time "in the future", but then the same problem concerning expiry/validity exists.

Thanks.

[zandbelt]

both slack_before and slack_after are only meant to deal with clock drift and should typically be left to their standard values

[DrakezulsMinimalism]

So I think I do not have a choice but to set "verify.iat=skip" as you mentioned.

I am still surprised about the way that iat s handled.
I expected the validation to be something like

iat + slack_after < now [eq. to "now - slack_after > iat"] instead of now + slack_after > iat

and

iat - slack_before < now [eq. to "now + slack_before > iat"] instead of now - slack_before < iat

Sorry to bother you with this further, but this was my last attempt at explaining my confusion.

Thanks for your help and this module as OSS!

[zandbelt]

I'm looking into this some more but I'm not sure what happened here: iat.verify.slack_before by default is set to 10 seconds which means that the allowed clock drift is 10 seconds. The iat.verify.slack_after is unset which means that the token would not be rejected if it is received somewhere in the future. Are you saying you observed otherwise?

[DrakezulsMinimalism]

Hi, sorry for the delay, I've been having a few days off.

I had to use slack_before with something bigger than 300s, because Azure, for some reason, does require some slack, however, after a few minutes, the token is not accepted anymore, even if it the expiry time is far away:

[Mon Jun 07 07:33:27.586253 2021] [oauth2:debug] [pid 34:tid 140344347842304] src/jose.c(925): [client 172.19.0.1:37722] _oauth2_jose_jwt_validate_iss: leave: 1
[Mon Jun 07 07:33:27.586258 2021] [oauth2:debug] [pid 34:tid 140344347842304] src/jose.c(939): [client 172.19.0.1:37722] _oauth2_jose_jwt_validate_exp: enter: validate=optional
[Mon Jun 07 07:33:27.586264 2021] [oauth2:debug] [pid 34:tid 140344347842304] src/jose.c(963): [client 172.19.0.1:37722] _oauth2_jose_jwt_validate_exp: "exp"=1623053899, 2692 seconds from now
[Mon Jun 07 07:33:27.586269 2021] [oauth2:debug] [pid 34:tid 140344347842304] src/jose.c(977): [client 172.19.0.1:37722] _oauth2_jose_jwt_validate_exp: leave: 1
[Mon Jun 07 07:33:27.586275 2021] [oauth2:debug] [pid 34:tid 140344347842304] src/jose.c(995): [client 172.19.0.1:37722] oauth2_jose_jwt_validate_iat: enter: validate=optional, slack_before=480, slack_after=4294967295
[Mon Jun 07 07:33:27.586280 2021] [oauth2:error] [pid 34:tid 140344347842304] [client 172.19.0.1:37722] oauth2_jose_jwt_validate_iat: "iat" validation failure (1623049999): JWT was issued more than 480 seconds ago

With the following configuration:

<Location "/">
    LogLevel trace3
    SSLRequireSSL
    AuthType oauth2
    OAuth2TokenVerify jwks_uri https://login.microsoftonline.com/${TenantID}/discovery/v2.0/keys verify.iat.slack_before=480
    Require valid-user
    ProxyPass https://127.0.0.1:9010/
    ProxyPassReverse https://127.0.0.1:9010/
    Order allow,deny
    Allow from all
</Location>

Flow summary:

1. Get token from azure
2. Send request to ApacheServer with token => accepted (exp and iat validation pass, with slack_before of 8mins)
3. Wait 10 minutes
4. Send request to ApacheServer with token => Unauthorized 401 (exp validation successful, iat validation failed)

[zandbelt]

oww, now I see: the default values were wrong... I corrected that in OpenIDC/liboauth2@33b2fe4 can you confirm that that fixes your issue without any additional configuration?

[DrakezulsMinimalism]

Thanks, I used

OAuth2TokenVerify jwks_uri https://login.microsoftonline.com/${TenantID}/discovery/v2.0/keys

without any verify.iat setting and the token works as expected now.

Just a short follow-up question:

1. slack_after is applied to allow the issuer to be "in the future" by the specified amount to still pass the validation
2. slack_before is applied as a "token max age", which allows the module's server to be in the future by the specified amount (if any), but if set, it might also really limit the "validity duration, i.e. exp duration since iat"

Also, the documentation in this repo (mod_oauth2) migth need an update concerning the default values.