feat: allow to configure JWT leeway in open_id_connect and increase default to 1 second

[jirutka]

Proposed changes

The default value defined in the jwt module is 0 seconds, so when the time is off just by a few milliseconds, the token validation fails with error "The token is not yet valid (iat)".

Checklist

• Lint and unit tests pass locally with my changes
• I have added tests that prove my fix is effective or that my feature works
  • This feature is already in the azuread_b2c and mediawiki backends, but there are no tests for it, so I don’t have any reference to based it on and don’t have time to figure it out myself.
• I have added documentation to https://github.com/python-social-auth/social-docs
  • I don’t see any documentation for the generic open_id_connect backend in https://github.com/python-social-auth/social-docs/tree/master/docs/backends.

[nijel]

Isn't ID_TOKEN_MAX_AGE supposed to cover this? It might be a caused by 013d27d where jose and pyjwt might behave differently in this.

[jirutka]

No, ID_TOKEN_MAX_AGE has a different purpose. As you can see in the code base, default value for ID_TOKEN_MAX_AGE is 600 and 3600 seconds, that would be too high for the leeway parameter. JWT_LEEWAY is used in JWT validation to allow a small amount of clock drift when verifying token expiration (exp), not-before (nbf), and issued-at (iat) claims.

[nijel]

that would be too high for the leeway parameter.

Having a wrong value doesn't mean it was not built with the same purpose. Apparently, ID_TOKEN_MAX_AGE is used to verify the iat claim (and is not applied to the nbf claim):

social-core/social_core/backends/open_id_connect.py

Lines 156 to 162 in 2b2a7e1

	if "nbf" in id_token and utc_timestamp < id_token["nbf"]:
	raise AuthTokenError(self, "Incorrect id_token: nbf")
	# Verify the token was issued in the last 10 minutes
	iat_leeway = self.setting("ID_TOKEN_MAX_AGE", self.ID_TOKEN_MAX_AGE)
	if utc_timestamp > id_token["iat"] + iat_leeway:
	raise AuthTokenError(self, "Incorrect id_token: iat")

If this validation is now done inside the JWT library, the additional logic probably can be removed and consolidated across the backends:

• OpenIdConnectAuth.validate_claims seems to duplicate the
• LinkedinOpenIdConnect seems to have a copy of this as well
• MediaWiki is passing leeway parameter to jwt.decode and doing manual validation later (but this one is not a OpenIdConnect subclass)