Replace openid-auth-timeout with openid-max-pkce-verifier-validity for consistency with openid-max-nonce-validity

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/AuthenticationProviderService.java

@@ -219,7 +219,7 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
 
                 // Store verifier for authenticateUser
                 OpenIDAuthenticationSession session = new OpenIDAuthenticationSession(codeVerifier,
-                            confService.getAuthenticationTimeout() * 60000L);
+                            confService.getMaxPKCEVerifierValidity() * 60000L);
                 String identifier = IdentifierGenerator.generateIdentifier();
                 sessionManager.defer(session, identifier);
 

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/conf/ConfigurationService.java

@@ -85,6 +85,12 @@ public class ConfigurationService {
      */
     private static final int DEFAULT_MAX_NONCE_VALIDITY = 10;
 
+    /**
+     * The default maximum amount of time that a nonce generated by the
+     * Guacamole server should remain valid, in minutes.
+     */
+    private static final int DEFAULT_MAX_PKCE_VERIFIER_VALIDITY = 10;
+
     /**
      * The authorization endpoint (URI) of the OpenID service.
      */
@@ -162,19 +168,20 @@ public class ConfigurationService {
     };
 
     /**
-     * The maximum amount of time to allow for an in-progress OpenID
+     * The maximum amount of time that a PKCE verifier generated by the
-     * authentication attempt to be completed, in minutes. A user that takes
+     * Guacamole server should remain valid, in minutes. As each OpenID request
-     * longer than this amount of time to complete authentication with their
+     * requiring PKCE has a unique verifier, this imposes an upper limit on the
-     * identity provider will be redirected back to the identity provider to
+     * amount of time any particular OpenID request can result in successful
-     * try again.
+     * authentication within Guacamole. By default, each generated PKCE verifier
+     * expires after 10 minutes.
      */
-    private static final IntegerGuacamoleProperty OPENID_AUTH_TIMEOUT =
+    private static final IntegerGuacamoleProperty OPENID_MAX_PKCE_VERIFIER_VALIDITY =
             new IntegerGuacamoleProperty() {
 
         @Override
-        public String getName() { return "openid-auth-timeout"; }
+        public String getName() { return "openid-max-pkce-verifier-validity"; }
-    };
 
+    };
 
     /**
      * The claim type which contains the authenticated user's username within
@@ -508,21 +515,21 @@ public class ConfigurationService {
     }
 
     /**
-     * Returns the maximum amount of time to allow for an in-progress OpenID
+     * Returns the maximum amount of time that a PKCE verifier generated by the
-     * authentication attempt to be completed, in minutes. A user that takes
+     * Guacamole server should remain valid, in minutes. As each OpenID request
-     * longer than this amount of time to complete authentication with their
+     * requiring PKCE has a unique verifier, this imposes an upper limit on the
-     * identity provider will be redirected back to the identity provider to
+     * amount of time any particular OpenID request can result in successful
-     * try again.
+     * authentication within Guacamole. By default, this will be 10.
      *
      * @return
-     *     The maximum amount of time to allow for an in-progress SAML
+     *     The maximum amount of time that a PKCE verifier generated by the
-     *     authentication attempt to be completed, in minutes.
+     *     Guacamole server should remain valid, in minutes.
      *
      * @throws GuacamoleException
-     *     If the authentication timeout cannot be parsed.
+     *     If guacamole.properties cannot be parsed.
      */
-    public int getAuthenticationTimeout() throws GuacamoleException {
+    public int getMaxPKCEVerifierValidity() throws GuacamoleException {
-        return environment.getProperty(OPENID_AUTH_TIMEOUT, 5);
+        return environment.getProperty(OPENID_MAX_PKCE_VERIFIER_VALIDITY, DEFAULT_MAX_PKCE_VERIFIER_VALIDITY);
     }
 
     /**