Add VCI Nonce TTL config

Author: cicnavi

composer.json

@@ -31,7 +31,7 @@
         "psr/container": "^2.0",
         "psr/log": "^3",
         "simplesamlphp/composer-module-installer": "^1.3",
-        "simplesamlphp/openid": "~v0.3.4",
+        "simplesamlphp/openid": "~v0.3.5",
         "spomky-labs/base64url": "^2.0",
         "symfony/expression-language": "^7.4",
         "symfony/psr-http-message-bridge": "^7.4",

config/module_oidc.php.dist

@@ -1261,6 +1261,14 @@ $config = [
      */
     ModuleConfig::OPTION_VCI_ISSUER_STATE_TTL => 'PT10M', // 10 minutes
 
+    /**
+     * (optional) Nonce TTL (validity duration) used for VCI proof-of-possession
+     * nonces, with the given example. If not set, defaults to 5 minutes. For
+     * duration format info, check
+     * https://www.php.net/manual/en/dateinterval.construct.php
+     */
+    ModuleConfig::OPTION_VCI_NONCE_TTL => 'PT5M', // 5 minutes
+
     /**
      * Map of authentication sources and user's email attribute names. This
      * enables you to define a specific attribute name which contains the

src/ModuleConfig.php

@@ -114,6 +114,7 @@ class ModuleConfig
     final public const string OPTION_AUTH_SOURCES_TO_USERS_EMAIL_ATTRIBUTE_NAME_MAP =
     'auth_sources_to_users_email_attribute_name_map';
     final public const string OPTION_VCI_ISSUER_STATE_TTL = 'vci_issuer_state_ttl';
+    final public const string OPTION_VCI_NONCE_TTL = 'vci_nonce_ttl';
     final public const string OPTION_VCI_ALLOW_NON_REGISTERED_CLIENTS = 'vci_allow_non_registered_clients';
     final public const string OPTION_VCI_ALLOWED_REDIRECT_URI_PREFIXES_FOR_NON_REGISTERED_CLIENTS =
     'vci_allowed_redirect_uri_prefixes_for_non_registered_clients';
@@ -1130,6 +1131,24 @@ public function getVciIssuerStateDuration(): DateInterval
         );
     }
 
+    /**
+     * Get Nonce TTL (validity duration) used for VCI proof-of-possession
+     * nonces. If not set, it defaults to 5 minutes.
+     *
+     * @return DateInterval
+     * @throws \Exception
+     */
+    public function getVciNonceTtl(): DateInterval
+    {
+        $nonceTtl = $this->config()->getOptionalString(self::OPTION_VCI_NONCE_TTL, null);
+
+        if (is_null($nonceTtl)) {
+            return new DateInterval('PT5M');
+        }
+
+        return new DateInterval($nonceTtl);
+    }
+
     public function getVciAllowNonRegisteredClients(): bool
     {
         return $this->config()->getOptionalBoolean(self::OPTION_VCI_ALLOW_NON_REGISTERED_CLIENTS, false);

src/Services/NonceService.php

@@ -4,6 +4,7 @@
 
 namespace SimpleSAML\Module\oidc\Services;
 
+use SimpleSAML\Module\oidc\Helpers;
 use SimpleSAML\Module\oidc\ModuleConfig;
 use SimpleSAML\OpenID\Codebooks\ClaimsEnum;
 use SimpleSAML\OpenID\Jws;
@@ -14,6 +15,7 @@ public function __construct(
         protected readonly Jws $jws,
         protected readonly ModuleConfig $moduleConfig,
         protected readonly LoggerService $loggerService,
+        protected readonly Helpers $helpers,
     ) {
     }
 
@@ -23,17 +25,17 @@ public function __construct(
     public function generateNonce(): string
     {
         $signatureKeyPair = $this->moduleConfig->getVciSignatureKeyPairBag()->getFirstOrFail();
-        $currentTimestamp = $this->jws->helpers()->dateTime()->getUtc()->getTimestamp();
+        $currentDateTime = $this->jws->helpers()->dateTime()->getUtc();
+        $currentTimestamp = $currentDateTime->getTimestamp();
 
-        // Nonce is valid for 5 minutes (300 seconds)
-        // TODO mivanci Consider making this configurable.
-        $expiryTimestamp = $currentTimestamp + 300;
+        // Nonce is valid for the configured TTL (defaults to 5 minutes).
+        $expiryTimestamp = $currentDateTime->add($this->moduleConfig->getVciNonceTtl())->getTimestamp();
 
         $payload = [
             ClaimsEnum::Iss->value => $this->moduleConfig->getIssuer(),
             ClaimsEnum::Iat->value => $currentTimestamp,
             ClaimsEnum::Exp->value => $expiryTimestamp,
-            'nonce_val' => bin2hex(random_bytes(16)),
+            ClaimsEnum::NonceVal->value => $this->helpers->random()->getIdentifier(16),
         ];
 
         $header = [

tests/unit/src/Services/NonceServiceTest.php

@@ -8,6 +8,8 @@
 use PHPUnit\Framework\Attributes\CoversClass;
 use PHPUnit\Framework\MockObject\MockObject;
 use PHPUnit\Framework\TestCase;
+use SimpleSAML\Module\oidc\Helpers as OidcHelpers;
+use SimpleSAML\Module\oidc\Helpers\Random as OidcRandom;
 use SimpleSAML\Module\oidc\ModuleConfig;
 use SimpleSAML\Module\oidc\Services\LoggerService;
 use SimpleSAML\Module\oidc\Services\NonceService;
@@ -34,6 +36,8 @@ class NonceServiceTest extends TestCase
     protected MockObject $signatureKeyPairMock;
     protected MockObject $helpersMock;
     protected MockObject $dateTimeHelperMock;
+    protected MockObject $oidcHelpersMock;
+    protected MockObject $oidcRandomMock;
 
     public function setUp(): void
     {
@@ -44,10 +48,13 @@ public function setUp(): void
         $this->parsedJwsMock = $this->createMock(ParsedJws::class);
         $this->helpersMock = $this->createMock(Helpers::class);
         $this->dateTimeHelperMock = $this->createMock(DateTime::class);
+        $this->oidcHelpersMock = $this->createMock(OidcHelpers::class);
+        $this->oidcRandomMock = $this->createMock(OidcRandom::class);
 
         $this->jwsMock->method('parsedJwsFactory')->willReturn($this->parsedJwsFactoryMock);
         $this->jwsMock->method('helpers')->willReturn($this->helpersMock);
         $this->helpersMock->method('dateTime')->willReturn($this->dateTimeHelperMock);
+        $this->oidcHelpersMock->method('random')->willReturn($this->oidcRandomMock);
 
         $this->signatureKeyPairMock = $this->createMock(SignatureKeyPair::class);
         $this->signatureKeyPairBagMock = $this->createMock(SignatureKeyPairBag::class);
@@ -57,8 +64,10 @@ public function setUp(): void
 
     public function testGenerateNonce(): void
     {
-        $this->dateTimeHelperMock->method('getUtc')->willReturn(new \DateTimeImmutable('2024-01-01 00:00:00'));
+        $currentDateTime = new \DateTimeImmutable('2024-01-01 00:00:00');
+        $this->dateTimeHelperMock->method('getUtc')->willReturn($currentDateTime);
         $this->moduleConfigMock->method('getIssuer')->willReturn('https://issuer.example.com');
+        $this->moduleConfigMock->method('getVciNonceTtl')->willReturn(new \DateInterval('PT5M'));
 
         $privateKeyMock = $this->createMock(JwkDecorator::class);
         $keyPairMock = $this->createMock(KeyPair::class);
@@ -67,13 +76,33 @@ public function testGenerateNonce(): void
         $this->signatureKeyPairMock->method('getKeyPair')->willReturn($keyPairMock);
         $this->signatureKeyPairMock->method('getSignatureAlgorithm')->willReturn(SignatureAlgorithmEnum::ES256);
 
+        $this->oidcRandomMock->expects($this->once())
+            ->method('getIdentifier')
+            ->with(16)
+            ->willReturn('mocked_random_nonce');
+
         $this->parsedJwsFactoryMock->expects($this->once())
             ->method('fromData')
+            ->with(
+                $this->anything(),
+                $this->anything(),
+                $this->callback(function (array $payload) use ($currentDateTime): bool {
+                    return $payload['iat'] === $currentDateTime->getTimestamp()
+                        && $payload['exp'] === $currentDateTime->getTimestamp() + 300
+                        && $payload['nonce_val'] === 'mocked_random_nonce';
+                }),
+                $this->anything(),
+            )
             ->willReturn($this->parsedJwsMock);
 
         $this->parsedJwsMock->method('getToken')->willReturn('mocked_token');
 
-        $sut = new NonceService($this->jwsMock, $this->moduleConfigMock, $this->loggerServiceMock);
+        $sut = new NonceService(
+            $this->jwsMock,
+            $this->moduleConfigMock,
+            $this->loggerServiceMock,
+            $this->oidcHelpersMock,
+        );
         $nonce = $sut->generateNonce();
 
         $this->assertEquals('mocked_token', $nonce);
@@ -98,7 +127,12 @@ public function testValidateNonceSuccess(): void
         $this->parsedJwsMock->method('getExpirationTime')
             ->willReturn((new \DateTimeImmutable('2024-01-01 00:00:00'))->getTimestamp() + 100);
 
-        $sut = new NonceService($this->jwsMock, $this->moduleConfigMock, $this->loggerServiceMock);
+        $sut = new NonceService(
+            $this->jwsMock,
+            $this->moduleConfigMock,
+            $this->loggerServiceMock,
+            $this->oidcHelpersMock,
+        );
         $this->assertTrue($sut->validateNonce('valid_token'));
     }
 
@@ -119,7 +153,12 @@ public function testValidateNonceInvalidIssuer(): void
         $this->parsedJwsMock->method('getIssuer')->willReturn('https://other.example.com');
         $this->moduleConfigMock->method('getIssuer')->willReturn('https://issuer.example.com');
 
-        $sut = new NonceService($this->jwsMock, $this->moduleConfigMock, $this->loggerServiceMock);
+        $sut = new NonceService(
+            $this->jwsMock,
+            $this->moduleConfigMock,
+            $this->loggerServiceMock,
+            $this->oidcHelpersMock,
+        );
         $this->assertFalse($sut->validateNonce('invalid_issuer_token'));
     }
 
@@ -142,7 +181,12 @@ public function testValidateNonceExpired(): void
         $this->parsedJwsMock->method('getExpirationTime')
             ->willReturn((new \DateTimeImmutable('2024-01-01 00:00:00'))->getTimestamp() - 10);
 
-        $sut = new NonceService($this->jwsMock, $this->moduleConfigMock, $this->loggerServiceMock);
+        $sut = new NonceService(
+            $this->jwsMock,
+            $this->moduleConfigMock,
+            $this->loggerServiceMock,
+            $this->oidcHelpersMock,
+        );
         $this->assertFalse($sut->validateNonce('expired_token'));
     }
 }