From 024a69695c70b1871849de511c7b95ecc407eb2f Mon Sep 17 00:00:00 2001 From: David Bateman Date: Mon, 13 Apr 2026 14:54:31 +0200 Subject: [PATCH] Replace openid-auth-timeout with openid-max-pkce-verifier-validity for consistency with openid-max-nonce-validity --- .../openid/AuthenticationProviderService.java | 2 +- .../openid/conf/ConfigurationService.java | 43 +++++++++++-------- 2 files changed, 26 insertions(+), 19 deletions(-) diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/AuthenticationProviderService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/AuthenticationProviderService.java index bb61c8126..3b1803aed 100644 --- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/AuthenticationProviderService.java +++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/AuthenticationProviderService.java @@ -219,7 +219,7 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS // Store verifier for authenticateUser OpenIDAuthenticationSession session = new OpenIDAuthenticationSession(codeVerifier, - confService.getAuthenticationTimeout() * 60000L); + confService.getMaxPKCEVerifierValidity() * 60000L); String identifier = IdentifierGenerator.generateIdentifier(); sessionManager.defer(session, identifier); diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/conf/ConfigurationService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/conf/ConfigurationService.java index f0727f3e4..a547c883b 100644 --- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/conf/ConfigurationService.java +++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/conf/ConfigurationService.java @@ -85,6 +85,12 @@ public class ConfigurationService { */ private static final int DEFAULT_MAX_NONCE_VALIDITY = 10; + /** + * The default maximum amount of time that a nonce generated by the + * Guacamole server should remain valid, in minutes. + */ + private static final int DEFAULT_MAX_PKCE_VERIFIER_VALIDITY = 10; + /** * The authorization endpoint (URI) of the OpenID service. */ @@ -162,19 +168,20 @@ public class ConfigurationService { }; /** - * The maximum amount of time to allow for an in-progress OpenID - * authentication attempt to be completed, in minutes. A user that takes - * longer than this amount of time to complete authentication with their - * identity provider will be redirected back to the identity provider to - * try again. + * The maximum amount of time that a PKCE verifier generated by the + * Guacamole server should remain valid, in minutes. As each OpenID request + * requiring PKCE has a unique verifier, this imposes an upper limit on the + * amount of time any particular OpenID request can result in successful + * authentication within Guacamole. By default, each generated PKCE verifier + * expires after 10 minutes. */ - private static final IntegerGuacamoleProperty OPENID_AUTH_TIMEOUT = + private static final IntegerGuacamoleProperty OPENID_MAX_PKCE_VERIFIER_VALIDITY = new IntegerGuacamoleProperty() { @Override - public String getName() { return "openid-auth-timeout"; } - }; + public String getName() { return "openid-max-pkce-verifier-validity"; } + }; /** * The claim type which contains the authenticated user's username within @@ -508,21 +515,21 @@ public class ConfigurationService { } /** - * Returns the maximum amount of time to allow for an in-progress OpenID - * authentication attempt to be completed, in minutes. A user that takes - * longer than this amount of time to complete authentication with their - * identity provider will be redirected back to the identity provider to - * try again. + * Returns the maximum amount of time that a PKCE verifier generated by the + * Guacamole server should remain valid, in minutes. As each OpenID request + * requiring PKCE has a unique verifier, this imposes an upper limit on the + * amount of time any particular OpenID request can result in successful + * authentication within Guacamole. By default, this will be 10. * * @return - * The maximum amount of time to allow for an in-progress SAML - * authentication attempt to be completed, in minutes. + * The maximum amount of time that a PKCE verifier generated by the + * Guacamole server should remain valid, in minutes. * * @throws GuacamoleException - * If the authentication timeout cannot be parsed. + * If guacamole.properties cannot be parsed. */ - public int getAuthenticationTimeout() throws GuacamoleException { - return environment.getProperty(OPENID_AUTH_TIMEOUT, 5); + public int getMaxPKCEVerifierValidity() throws GuacamoleException { + return environment.getProperty(OPENID_MAX_PKCE_VERIFIER_VALIDITY, DEFAULT_MAX_PKCE_VERIFIER_VALIDITY); } /**