{"action":"created","issue":{"url":"https://api.github.com/repos/spring-projects/spring-security/issues/5839","repository_url":"https://api.github.com/repos/spring-projects/spring-security","labels_url":"https://api.github.com/repos/spring-projects/spring-security/issues/5839/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-security/issues/5839/comments","events_url":"https://api.github.com/repos/spring-projects/spring-security/issues/5839/events","html_url":"https://github.com/spring-projects/spring-security/issues/5839","id":359814052,"node_id":"MDU6SXNzdWUzNTk4MTQwNTI=","number":5839,"title":"maxIssuedAt check issue in OidcAuthorizationCodeAuthenticationProvider and id token validation enhance requirement","user":{"login":"zcwang3","id":22088987,"node_id":"MDQ6VXNlcjIyMDg4OTg3","avatar_url":"https://avatars1.githubusercontent.com/u/22088987?v=4","gravatar_id":"","url":"https://api.github.com/users/zcwang3","html_url":"https://github.com/zcwang3","followers_url":"https://api.github.com/users/zcwang3/followers","following_url":"https://api.github.com/users/zcwang3/following{/other_user}","gists_url":"https://api.github.com/users/zcwang3/gists{/gist_id}","starred_url":"https://api.github.com/users/zcwang3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zcwang3/subscriptions","organizations_url":"https://api.github.com/users/zcwang3/orgs","repos_url":"https://api.github.com/users/zcwang3/repos","events_url":"https://api.github.com/users/zcwang3/events{/privacy}","received_events_url":"https://api.github.com/users/zcwang3/received_events","type":"User","site_admin":false},"labels":[{"id":84690697,"node_id":"MDU6TGFiZWw4NDY5MDY5Nw==","url":"https://api.github.com/repos/spring-projects/spring-security/labels/waiting-for-feedback","name":"waiting-for-feedback","color":"eb6420","default":false}],"state":"open","locked":false,"assignee":{"login":"jgrandja","id":10884212,"node_id":"MDQ6VXNlcjEwODg0MjEy","avatar_url":"https://avatars1.githubusercontent.com/u/10884212?v=4","gravatar_id":"","url":"https://api.github.com/users/jgrandja","html_url":"https://github.com/jgrandja","followers_url":"https://api.github.com/users/jgrandja/followers","following_url":"https://api.github.com/users/jgrandja/following{/other_user}","gists_url":"https://api.github.com/users/jgrandja/gists{/gist_id}","starred_url":"https://api.github.com/users/jgrandja/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jgrandja/subscriptions","organizations_url":"https://api.github.com/users/jgrandja/orgs","repos_url":"https://api.github.com/users/jgrandja/repos","events_url":"https://api.github.com/users/jgrandja/events{/privacy}","received_events_url":"https://api.github.com/users/jgrandja/received_events","type":"User","site_admin":false},"assignees":[{"login":"jgrandja","id":10884212,"node_id":"MDQ6VXNlcjEwODg0MjEy","avatar_url":"https://avatars1.githubusercontent.com/u/10884212?v=4","gravatar_id":"","url":"https://api.github.com/users/jgrandja","html_url":"https://github.com/jgrandja","followers_url":"https://api.github.com/users/jgrandja/followers","following_url":"https://api.github.com/users/jgrandja/following{/other_user}","gists_url":"https://api.github.com/users/jgrandja/gists{/gist_id}","starred_url":"https://api.github.com/users/jgrandja/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jgrandja/subscriptions","organizations_url":"https://api.github.com/users/jgrandja/orgs","repos_url":"https://api.github.com/users/jgrandja/repos","events_url":"https://api.github.com/users/jgrandja/events{/privacy}","received_events_url":"https://api.github.com/users/jgrandja/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/spring-projects/spring-security/milestones/125","html_url":"https://github.com/spring-projects/spring-security/milestone/125","labels_url":"https://api.github.com/repos/spring-projects/spring-security/milestones/125/labels","id":3725775,"node_id":"MDk6TWlsZXN0b25lMzcyNTc3NQ==","number":125,"title":"5.2.0","description":"","creator":{"login":"jgrandja","id":10884212,"node_id":"MDQ6VXNlcjEwODg0MjEy","avatar_url":"https://avatars1.githubusercontent.com/u/10884212?v=4","gravatar_id":"","url":"https://api.github.com/users/jgrandja","html_url":"https://github.com/jgrandja","followers_url":"https://api.github.com/users/jgrandja/followers","following_url":"https://api.github.com/users/jgrandja/following{/other_user}","gists_url":"https://api.github.com/users/jgrandja/gists{/gist_id}","starred_url":"https://api.github.com/users/jgrandja/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jgrandja/subscriptions","organizations_url":"https://api.github.com/users/jgrandja/orgs","repos_url":"https://api.github.com/users/jgrandja/repos","events_url":"https://api.github.com/users/jgrandja/events{/privacy}","received_events_url":"https://api.github.com/users/jgrandja/received_events","type":"User","site_admin":false},"open_issues":6,"closed_issues":0,"state":"open","created_at":"2018-10-09T21:01:19Z","updated_at":"2018-10-12T16:04:49Z","due_on":null,"closed_at":null},"comments":8,"created_at":"2018-09-13T09:26:22Z","updated_at":"2018-10-17T03:17:10Z","closed_at":null,"author_association":"NONE","body":"### Summary\r\nI am using spring security 5.0.7 with spring boot 2.0.4.RELEASE for login with Google and Login with Microsoft feature.\r\n\r\nI meet the same issue of [OidcAuthorizationCodeAuthenticationProvider maxIssuedAt](https://github.com/spring-projects/spring-security/issues/5189) which  is **closed without any enhancement**\r\n\r\n### Actual Behavior\r\nToday, when i login with Google account in one of my testing machine, I meet the issue with follow error message:\r\nc.c.w.g.c.SecurityConfiguration$2 - Authentication request failed: org.springframework.security.oauth2.core.OAuth2AuthenticationException: [**invalid_id_token**] \r\n\r\nit **does not output the detail reason why id token is invalid**: like aud is null **or** audience is not same with client id **or** idToken is expired etc.\r\n\r\nAfter debug, I find that the failure reason is because of issuedAt.isAfter(maxIssuedAt) check failure, you can see detail error reason in the following screen shots:\r\n![image2018-9-13_17-2-39](https://user-images.githubusercontent.com/22088987/45479339-d3130e00-b778-11e8-8c98-0a52b8a1a8af.png)\r\n\r\n### Expected Behavior\r\nLogin with Microsoft and Google account should be successful in all different machines with some grace time \r\n\r\n**Please notice** \r\nLogin with Microsoft account with ID token is successful in the same machine. \r\nLogin with Google account with ID token is failure because of issuedAt.isAfter(maxIssuedAt) check failure\r\nLogin with Microsoft and Google account with ID token are both successful in other testing machines\r\n\r\n\r\nSince we can not control the issuedAt value which generated by Microsoft or Google and issuedAt generated by Microsoft and Google is obviously different in my testing machine.\r\n\r\n**_Enhance request 1_**: add detail error reason in exception when id_tioken validate failure\r\n**_Enhance request 2_**: default 30 second in the check of issuedAt.isAfter(maxIssuedAt) becomes configurable\r\n**_Suggestion to fix with existing spring security version_** : And for current spring security version without previous enhance support, how can I do to change the value of 30 to 300s, do we have some extension point for it without change sourcecode in jar?\r\n\r\n### Configuration\r\nno special configuration, the issue is just related with id token check logic in OidcAuthorizationCodeAuthenticationProvider\r\n\r\n### Version\r\n  <parent>\r\n        <groupId>org.springframework.boot</groupId>\r\n        <artifactId>spring-boot-starter-parent</artifactId>\r\n        <version>2.0.4.RELEASE</version>\r\n    </parent>\r\n\r\n     <dependency>\r\n            <groupId>org.springframework.boot</groupId>\r\n            <artifactId>spring-boot-starter-security</artifactId>\r\n        </dependency>\r\n        <dependency>\r\n            <groupId>org.springframework.security</groupId>\r\n            <artifactId>spring-security-oauth2-client</artifactId>\r\n        </dependency>\r\n        <dependency>\r\n            <groupId>org.springframework.security</groupId>\r\n            <artifactId>spring-security-oauth2-jose</artifactId>\r\n        </dependency>\r\n\r\n### Sample\r\nno special configuration, the issue is just related with id token check logic in OidcAuthorizationCodeAuthenticationProvider"},"comment":{"url":"https://api.github.com/repos/spring-projects/spring-security/issues/comments/430475265","html_url":"https://github.com/spring-projects/spring-security/issues/5839#issuecomment-430475265","issue_url":"https://api.github.com/repos/spring-projects/spring-security/issues/5839","id":430475265,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMDQ3NTI2NQ==","user":{"login":"zcwang3","id":22088987,"node_id":"MDQ6VXNlcjIyMDg4OTg3","avatar_url":"https://avatars1.githubusercontent.com/u/22088987?v=4","gravatar_id":"","url":"https://api.github.com/users/zcwang3","html_url":"https://github.com/zcwang3","followers_url":"https://api.github.com/users/zcwang3/followers","following_url":"https://api.github.com/users/zcwang3/following{/other_user}","gists_url":"https://api.github.com/users/zcwang3/gists{/gist_id}","starred_url":"https://api.github.com/users/zcwang3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zcwang3/subscriptions","organizations_url":"https://api.github.com/users/zcwang3/orgs","repos_url":"https://api.github.com/users/zcwang3/repos","events_url":"https://api.github.com/users/zcwang3/events{/privacy}","received_events_url":"https://api.github.com/users/zcwang3/received_events","type":"User","site_admin":false},"created_at":"2018-10-17T03:17:10Z","updated_at":"2018-10-17T03:17:10Z","author_association":"NONE","body":"@jgrandja I am work overtime for my daily work and not have time to work on #5930 now.\r\nMay be I will try to pick it up later if I have time.\r\n\r\nThanks"}}
{"actor":{"display_login":"zcwang3"}}