keycloak/keycloak
High values for client secret expiration result in expiration dates in the past
Fechada
#38.124 aberto em 14 de mar. de 2025
area/corehelp wantedkind/bugpriority/normalstatus/auto-bumpteam/core-clientsteam/core-shared
Métricas do repositório
- Stars
- (34.398 estrelas)
- Métricas de merge de PR
- (Métricas PR pendentes)
Description
Before reporting an issue
- I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
core
Describe the bug
Using a (signed) int, allows to use expiration dates up to 2038 in its current implementation because Time.currentTime() is added to the secret expiration offset. Please use a Long instead for expiration:
Version
26.1.4
Regression
- The issue is a regression
Expected behavior
I would like to set expiration times that allow to go beyond 2038.
Actual behavior
When setting an expiration time of 2147483647 (max signed int value) I get an expiration time that lies in the past.
How to Reproduce?
Activate the client-secret-rotation feature.
Create a policy as explained here. Use a secret expiration of 2147483647.
Generate a new secret for a non-public client. Look at the expiration time. I will be in the past.
Anything else?
No response