cloudfoundry / cloudfoundry/uaa
Specify maximum active tokens per user per client
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.6k
- Forks
- 844
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 27
Description
In order to comply with https://web.nvd.nist.gov/view/800-53/Rev4/control?controlName=AC-10, we would like to be able to control the maximum number of active tokens per user per client, such that old tokens are automatically invalidated when the limit is exceeded. An example interface might look like this:
properties:
uaa:
clients:
my-client:
max-active-tokens: 2
From slack:
@jmcarp We are currently working on features along those lines. Starting with only 1 active refresh token per client/user combo
cc @rememberlenny @cnelson @mogul
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source file or test is named. Start by tracing the existing client configuration and token lifecycle, using the YAML example and AC-10 reference as requirements; done means enforcing a per-user, per-client active-token limit and invalidating older tokens when it is exceeded.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100