feat(jwt): remove code that deals with exp and iat fields

agukasm · mrts · commit 8db3ddaee95a · 2021-11-23T19:04:39.000+02:00
WE2-584

Signed-off-by: Mati Agukas &lt;mati.agukas@cgi.com&gt;
diff --git a/src/WebEid.Security.Tests/TestUtils/AuthTokenValidators.cs b/src/WebEid.Security.Tests/TestUtils/AuthTokenValidators.cs
@@ -25,7 +25,6 @@ public static IAuthTokenValidator GetAuthTokenValidator(string url, ICache<DateT
         {
             return GetAuthTokenValidatorBuilder(url, cache, certificates)
                 // Assure that all builder methods are covered with tests.
-                .WithAllowedClientClockSkew(TimeSpan.FromMinutes(2))
                 .WithOcspRequestTimeout(TimeSpan.FromSeconds(1))
                 .WithNonceDisabledOcspUrls(new Uri("http://example.org"))
                 .WithoutUserCertificateRevocationCheckWithOcsp()
diff --git a/src/WebEid.Security.Tests/TestUtils/Tokens.cs b/src/WebEid.Security.Tests/TestUtils/Tokens.cs
@@ -7,6 +7,9 @@ internal static class Tokens
         public const string SignedTest =
             "eyJhbGciOiJFUzM4NCIsInR5cCI6IkpXVCIsIng1YyI6WyJNSUlFQXpDQ0EyV2dBd0lCQWdJUU9Xa0JXWE5ESm0xYnlGZDNYc1drdmpBS0JnZ3Foa2pPUFFRREJEQmdNUXN3Q1FZRFZRUUdFd0pGUlRFYk1Ca0dBMVVFQ2d3U1Uwc2dTVVFnVTI5c2RYUnBiMjV6SUVGVE1SY3dGUVlEVlFSaERBNU9WRkpGUlMweE1EYzBOekF4TXpFYk1Ca0dBMVVFQXd3U1ZFVlRWQ0J2WmlCRlUxUkZTVVF5TURFNE1CNFhEVEU0TVRBeE9EQTVOVEEwTjFvWERUSXpNVEF4TnpJeE5UazFPVm93ZnpFTE1Ba0dBMVVFQmhNQ1JVVXhLakFvQmdOVkJBTU1JVXJEbFVWUFVrY3NTa0ZCU3kxTFVrbFRWRXBCVGl3ek9EQXdNVEE0TlRjeE9ERVFNQTRHQTFVRUJBd0hTc09WUlU5U1J6RVdNQlFHQTFVRUtnd05Ta0ZCU3kxTFVrbFRWRXBCVGpFYU1CZ0dBMVVFQlJNUlVFNVBSVVV0TXpnd01ERXdPRFUzTVRnd2RqQVFCZ2NxaGtqT1BRSUJCZ1VyZ1FRQUlnTmlBQVI1azFsWHp2U2VJOU8vMXMxcFp2amhFVzhuSXRKb0cwRUJGeG1MRVk2UzdraTF2RjJRM1RFRHg2ZE56dEkxWHR4OTZjczhyNHpZVHdkaVFvRGc3azNkaVV1UjluVFdHeFFFTU8xRkRvNFk5ZkFtaVBHV1QrK0d1T1ZvWlFZM1h4aWpnZ0hETUlJQnZ6QUpCZ05WSFJNRUFqQUFNQTRHQTFVZER3RUIvd1FFQXdJRGlEQkhCZ05WSFNBRVFEQStNRElHQ3lzR0FRUUJnNUVoQVFJQk1DTXdJUVlJS3dZQkJRVUhBZ0VXRldoMGRIQnpPaTh2ZDNkM0xuTnJMbVZsTDBOUVV6QUlCZ1lFQUk5NkFRSXdId1lEVlIwUkJCZ3dGb0VVTXpnd01ERXdPRFUzTVRoQVpXVnpkR2t1WldVd0hRWURWUjBPQkJZRUZPUXN2VFFKRUJWTU1TbWh5Wlg1YmliWUp1YkFNR0VHQ0NzR0FRVUZCd0VEQkZVd1V6QlJCZ1lFQUk1R0FRVXdSekJGRmo5b2RIUndjem92TDNOckxtVmxMMlZ1TDNKbGNHOXphWFJ2Y25rdlkyOXVaR2wwYVc5dWN5MW1iM0l0ZFhObExXOW1MV05sY25ScFptbGpZWFJsY3k4VEFrVk9NQ0FHQTFVZEpRRUIvd1FXTUJRR0NDc0dBUVVGQndNQ0JnZ3JCZ0VGQlFjREJEQWZCZ05WSFNNRUdEQVdnQlRBaEprcHhFNmZPd0kwOXBuaENsWUFDQ2srZXpCekJnZ3JCZ0VGQlFjQkFRUm5NR1V3TEFZSUt3WUJCUVVITUFHR0lHaDBkSEE2THk5aGFXRXVaR1Z0Ynk1emF5NWxaUzlsYzNSbGFXUXlNREU0TURVR0NDc0dBUVVGQnpBQ2hpbG9kSFJ3T2k4dll5NXpheTVsWlM5VVpYTjBYMjltWDBWVFZFVkpSREl3TVRndVpHVnlMbU55ZERBS0JnZ3Foa2pPUFFRREJBT0Jpd0F3Z1ljQ1FnSDFVc21NZHRMWnRpNTFGcTJRUjR3VWtBd3BzbmhzQlYySFFxVVhGWUJKN0VYbkxDa2FYamRaS2tIcEFCZk0wUUV4N1VVaGFJNGk1M2ppSjdFMVk3V09BQUpCRFg0ejYxcG5pSEphcEkxYmtNSWlKUS90aTdoYThmZEpTTVNwQWRzNUN5SEl5SGtReldsVnk4NmY5bUE3RXUzb1JPLzFxK2VGVXpEYk5OM1Z2eTdnUVdRPSJdfQ.eyJhdWQiOlsiaHR0cHM6Ly9yaWEuZWUiLCJ1cm46Y2VydDpzaGEtMjU2OjZmMGRmMjQ0ZTRhODU2Yjk0YjNiM2I0NzU4MmEwYTUxYTMyZDY3NGRiYzcxMDcyMTFlZDIzZDRiZWM2ZDljNzIiXSwiZXhwIjoiMTU4Njg3MTE2OSIsImlhdCI6IjE1ODY4NzA4NjkiLCJpc3MiOiJ3ZWItZWlkIGFwcCB2MC45LjAtMS1nZTZlODlmYSIsIm5vbmNlIjoiMTIzNDU2NzgxMjM0NTY3ODEyMzQ1Njc4MTIzNDU2NzgiLCJzdWIiOiJKw5VFT1JHLEpBQUstS1JJU1RKQU4sMzgwMDEwODU3MTgifQ.0Y5CdMiSZ14rOnd7sbp-XeBQ7qrJVd21yTmAbiRnzAXtwqW8ZROg4jL4J7bpQ2fwyUz4-dVwLoVRVnxfJY82b8NXuxXrDb-8MXXmVYrMW0q0kPbEzqFbEnPYHjNnKAN0";
 
+        public const string MinimalFormat =
+            "eyJhbGciOiJFUzM4NCIsInR5cCI6IkpXVCIsIng1YyI6WyJNSUlFQXpDQ0EyV2dBd0lCQWdJUUhXYlZXeENrY1l4Ynp6OW5CekdyRHpBS0JnZ3Foa2pPUFFRREJEQmdNUXN3Q1FZRFZRUUdFd0pGUlRFYk1Ca0dBMVVFQ2d3U1Uwc2dTVVFnVTI5c2RYUnBiMjV6SUVGVE1SY3dGUVlEVlFSaERBNU9WRkpGUlMweE1EYzBOekF4TXpFYk1Ca0dBMVVFQXd3U1ZFVlRWQ0J2WmlCRlUxUkZTVVF5TURFNE1CNFhEVEU0TVRBeU16RTFNek0xT1ZvWERUSXpNVEF5TWpJeE5UazFPVm93ZnpFTE1Ba0dBMVVFQmhNQ1JVVXhLakFvQmdOVkJBTU1JVXJEbFVWUFVrY3NTa0ZCU3kxTFVrbFRWRXBCVGl3ek9EQXdNVEE0TlRjeE9ERVFNQTRHQTFVRUJBd0hTc09WUlU5U1J6RVdNQlFHQTFVRUtnd05Ta0ZCU3kxTFVrbFRWRXBCVGpFYU1CZ0dBMVVFQlJNUlVFNVBSVVV0TXpnd01ERXdPRFUzTVRnd2RqQVFCZ2NxaGtqT1BRSUJCZ1VyZ1FRQUlnTmlBQVEvdSs5SW5jYXJWcGdyQUNONmFSZ1VpVDlsV0M5SDdsbG54b0VYZTh4b0NJOTgyTWQ4WXVKc1ZmUmRlRzVqd1ZmWGUwTjZLa0hMRlJBUnNwc3Q4cW5BQ1VMa3FGTmF0L0tqK1hSd0oyVUFOZUozR2w1WEJyK3RuTE51RGYvVWlSNmpnZ0hETUlJQnZ6QUpCZ05WSFJNRUFqQUFNQTRHQTFVZER3RUIvd1FFQXdJRGlEQkhCZ05WSFNBRVFEQStNRElHQ3lzR0FRUUJnNUVoQVFJQk1DTXdJUVlJS3dZQkJRVUhBZ0VXRldoMGRIQnpPaTh2ZDNkM0xuTnJMbVZsTDBOUVV6QUlCZ1lFQUk5NkFRSXdId1lEVlIwUkJCZ3dGb0VVTXpnd01ERXdPRFUzTVRoQVpXVnpkR2t1WldVd0hRWURWUjBPQkJZRUZPVGRkSG5BOXJKdGJMd2hCTnluMHhaVFFHQ01NR0VHQ0NzR0FRVUZCd0VEQkZVd1V6QlJCZ1lFQUk1R0FRVXdSekJGRmo5b2RIUndjem92TDNOckxtVmxMMlZ1TDNKbGNHOXphWFJ2Y25rdlkyOXVaR2wwYVc5dWN5MW1iM0l0ZFhObExXOW1MV05sY25ScFptbGpZWFJsY3k4VEFrVk9NQ0FHQTFVZEpRRUIvd1FXTUJRR0NDc0dBUVVGQndNQ0JnZ3JCZ0VGQlFjREJEQWZCZ05WSFNNRUdEQVdnQlRBaEprcHhFNmZPd0kwOXBuaENsWUFDQ2srZXpCekJnZ3JCZ0VGQlFjQkFRUm5NR1V3TEFZSUt3WUJCUVVITUFHR0lHaDBkSEE2THk5aGFXRXVaR1Z0Ynk1emF5NWxaUzlsYzNSbGFXUXlNREU0TURVR0NDc0dBUVVGQnpBQ2hpbG9kSFJ3T2k4dll5NXpheTVsWlM5VVpYTjBYMjltWDBWVFZFVkpSREl3TVRndVpHVnlMbU55ZERBS0JnZ3Foa2pPUFFRREJBT0Jpd0F3Z1ljQ1FnSFlFbGtYNHZuODIxSlI0MWFrSS9scGV4Q25KRlVmNEdpT01iVGZ6QXhwWm1hMzMzUjhMTnJtSTR6YnpEcDAzaHZNVHpINDlnMWpjYkduYUNjYmJvUzhEQUpCT2JlblVwKytMNVZxbGRId0tBcHM2MW5NNFYrVGlMcUQwaklMblR6bCtwVitMZXhOTDN1R3pVZnZ2RE5MSG5GOXQ2eWdpOCtCc2pzdTNpSEh5TTFoYUtNPSJdfQ.eyJhdWQiOlsiaHR0cHM6Ly9yaWEuZWUiLCJ1cm46Y2VydDpzaGEtMjU2OjZmMGRmMjQ0ZTRhODU2Yjk0YjNiM2I0NzU4MmEwYTUxYTMyZDY3NGRiYzcxMDcyMTFlZDIzZDRiZWM2ZDljNzIiXSwiaXNzIjoid2ViLWVpZCBhcHAgMS4wLjIrMCIsIm5vbmNlIjoiMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTEifQ.bICTrRYMbuHLb59ch6dVJIMB1c3046CX-G9Tb3G_d9dA9gOup4Z-n_GAaVas9MAoj7P6NM0Usal_JW3_PFGfRYF0Ji79a_vhAUCsLkqp6JhnSlnv4MJvN5cYef24s4aP";
+
         public const string Corrupted =
             "e1yJhbGciOiJFUzM4NCIsInR5cCI6IkpXVCIsIng1YyI6WyJNSUlFQXpDQ0EyV2dBd0lCQWdJUU9Xa0JXWE5ESm0xYnlGZDNYc1drdmpBS0JnZ3Foa2pPUFFRREJEQmdNUXN3Q1FZRFZRUUdFd0pGUlRFYk1Ca0dBMVVFQ2d3U1Uwc2dTVVFnVTI5c2RYUnBiMjV6SUVGVE1SY3dGUVlEVlFSaERBNU9WRkpGUlMweE1EYzBOekF4TXpFYk1Ca0dBMVVFQXd3U1ZFVlRWQ0J2WmlCRlUxUkZTVVF5TURFNE1CNFhEVEU0TVRBeE9EQTVOVEEwTjFvWERUSXpNVEF4TnpJeE5UazFPVm93ZnpFTE1Ba0dBMVVFQmhNQ1JVVXhLakFvQmdOVkJBTU1JVXJEbFVWUFVrY3NTa0ZCU3kxTFVrbFRWRXBCVGl3ek9EQXdNVEE0TlRjeE9ERVFNQTRHQTFVRUJBd0hTc09WUlU5U1J6RVdNQlFHQTFVRUtnd05Ta0ZCU3kxTFVrbFRWRXBCVGpFYU1CZ0dBMVVFQlJNUlVFNVBSVVV0TXpnd01ERXdPRFUzTVRnd2RqQVFCZ2NxaGtqT1BRSUJCZ1VyZ1FRQUlnTmlBQVI1azFsWHp2U2VJOU8vMXMxcFp2amhFVzhuSXRKb0cwRUJGeG1MRVk2UzdraTF2RjJRM1RFRHg2ZE56dEkxWHR4OTZjczhyNHpZVHdkaVFvRGc3azNkaVV1UjluVFdHeFFFTU8xRkRvNFk5ZkFtaVBHV1QrK0d1T1ZvWlFZM1h4aWpnZ0hETUlJQnZ6QUpCZ05WSFJNRUFqQUFNQTRHQTFVZER3RUIvd1FFQXdJRGlEQkhCZ05WSFNBRVFEQStNRElHQ3lzR0FRUUJnNUVoQVFJQk1DTXdJUVlJS3dZQkJRVUhBZ0VXRldoMGRIQnpPaTh2ZDNkM0xuTnJMbVZsTDBOUVV6QUlCZ1lFQUk5NkFRSXdId1lEVlIwUkJCZ3dGb0VVTXpnd01ERXdPRFUzTVRoQVpXVnpkR2t1WldVd0hRWURWUjBPQkJZRUZPUXN2VFFKRUJWTU1TbWh5Wlg1YmliWUp1YkFNR0VHQ0NzR0FRVUZCd0VEQkZVd1V6QlJCZ1lFQUk1R0FRVXdSekJGRmo5b2RIUndjem92TDNOckxtVmxMMlZ1TDNKbGNHOXphWFJ2Y25rdlkyOXVaR2wwYVc5dWN5MW1iM0l0ZFhObExXOW1MV05sY25ScFptbGpZWFJsY3k4VEFrVk9NQ0FHQTFVZEpRRUIvd1FXTUJRR0NDc0dBUVVGQndNQ0JnZ3JCZ0VGQlFjREJEQWZCZ05WSFNNRUdEQVdnQlRBaEprcHhFNmZPd0kwOXBuaENsWUFDQ2srZXpCekJnZ3JCZ0VGQlFjQkFRUm5NR1V3TEFZSUt3WUJCUVVITUFHR0lHaDBkSEE2THk5aGFXRXVaR1Z0Ynk1emF5NWxaUzlsYzNSbGFXUXlNREU0TURVR0NDc0dBUVVGQnpBQ2hpbG9kSFJ3T2k4dll5NXpheTVsWlM5VVpYTjBYMjltWDBWVFZFVkpSREl3TVRndVpHVnlMbU55ZERBS0JnZ3Foa2pPUFFRREJBT0Jpd0F3Z1ljQ1FnSDFVc21NZHRMWnRpNTFGcTJRUjR3VWtBd3BzbmhzQlYySFFxVVhGWUJKN0VYbkxDa2FYamRaS2tIcEFCZk0wUUV4N1VVaGFJNGk1M2ppSjdFMVk3V09BQUpCRFg0ejYxcG5pSEphcEkxYmtNSWlKUS90aTdoYThmZEpTTVNwQWRzNUN5SEl5SGtReldsVnk4NmY5bUE3RXUzb1JPLzFxK2VGVXpEYk5OM1Z2eTdnUVdRPSJdfQ.eyJhdWQiOlsiaHR0cHM6Ly9yaWEuZWUiLCJ1cm46Y2VydDpzaGEtMjU2OjZmMGRmMjQ0ZTRhODU2Yjk0YjNiM2I0NzU4MmEwYTUxYTMyZDY3NGRiYzcxMDcyMTFlZDIzZDRiZWM2ZDljNzIiXSwiZXhwIjoiMTU4Njg3MTE2OSIsImlhdCI6IjE1ODY4NzA4NjkiLCJpc3MiOiJ3ZWItZWlkIGFwcCB2MC45LjAtMS1nZTZlODlmYSIsIm5vbmNlIjoiMTIzNDU2NzgxMjM0NTY3ODEyMzQ1Njc4MTIzNDU2NzgiLCJzdWIiOiJKw5VFT1JHLEpBQUstS1JJU1RKQU4sMzgwMDEwODU3MTgif1Q.0Y5CdMiSZ14rOnd7sbp-XeBQ7qrJVd21yTmAbiRnzAXtwqW8ZROg4jL4J7bpQ2fwyUz4-dVwLoVRVnxfJY82b8NXuxXrDb-8MXXmVYrMW0q0kPbEzqFbEnPYHjNnKAN0";
 
diff --git a/src/WebEid.Security.Tests/Validator/AuthTokenParserTests.cs b/src/WebEid.Security.Tests/Validator/AuthTokenParserTests.cs
@@ -1,6 +1,5 @@
 namespace WebEid.Security.Tests.Validator
 {
-    using System;
     using Exceptions;
     using NUnit.Framework;
     using Security.Validator;
@@ -9,12 +8,10 @@ namespace WebEid.Security.Tests.Validator
     [TestFixture]
     public class AuthTokenParserTests
     {
-        private readonly TimeSpan allowedClockSkew = TimeSpan.FromMinutes(3);
-
         [Test]
         public void PopulateDataFromClaimsFillsCorrectDataAndValidationDoesNotFailFromValidToken()
         {
-            var parser = new AuthTokenParser(Tokens.SignedTest, this.allowedClockSkew, null);
+            var parser = new AuthTokenParser(Tokens.SignedTest, null);
             var data = parser.ParseHeaderFromTokenString();
             parser.ParseClaims();
             parser.PopulateDataFromClaims(data);
@@ -32,43 +29,43 @@ public void PopulateDataFromClaimsFillsCorrectDataAndValidationDoesNotFailFromVa
         [Test]
         public void ParseHeaderFromTokenStringWithMissingX5CFieldThrowsTokenParseException()
         {
-            var parser = new AuthTokenParser(Tokens.X5CMissing, this.allowedClockSkew, null);
+            var parser = new AuthTokenParser(Tokens.X5CMissing, null);
             Assert.Throws<TokenParseException>(() => parser.ParseHeaderFromTokenString());
         }
 
         [Test]
         public void ParseHeaderFromTokenStringWithIncorrectX5CValueThrowsTokenParseException()
         {
-            var parser = new AuthTokenParser(Tokens.X5CNotString, this.allowedClockSkew, null);
+            var parser = new AuthTokenParser(Tokens.X5CNotString, null);
             Assert.Throws<TokenParseException>(() => parser.ParseHeaderFromTokenString());
         }
 
         [Test]
         public void ParseHeaderFromTokenStringWithIncorrectX5CListValueThrowsTokenParseException()
         {
-            var parser = new AuthTokenParser(Tokens.X5CNotArray, this.allowedClockSkew, null);
+            var parser = new AuthTokenParser(Tokens.X5CNotArray, null);
             Assert.Throws<TokenParseException>(() => parser.ParseHeaderFromTokenString());
         }
 
         [Test]
         public void ParseHeaderFromTokenStringWithX5CEmptyValueThrowsTokenParseException()
         {
-            var parser = new AuthTokenParser(Tokens.X5CEmpty, this.allowedClockSkew, null);
+            var parser = new AuthTokenParser(Tokens.X5CEmpty, null);
             Assert.Throws<TokenParseException>(() => parser.ParseHeaderFromTokenString());
         }
 
         [Test]
-        public void ValidateRsaTokenSignatureThrowsTokenExpiredException()
+        public void JwtWithoutDateFieldsDoesNotThrow()
         {
-            var parser = new AuthTokenParser(Tokens.TokenCertRsa, this.allowedClockSkew, null);
+            var parser = new AuthTokenParser(Tokens.MinimalFormat, null);
             var validatorData = parser.ParseHeaderFromTokenString();
-            Assert.Throws<TokenExpiredException>(() => parser.ValidateTokenSignature(validatorData.SubjectCertificate));
+            Assert.DoesNotThrow(() => parser.ValidateTokenSignature(validatorData.SubjectCertificate));
         }
 
         [Test]
         public void ParseHeaderFromTokenStringWithInvalidX5CCertificateThrowsTokenParseException()
         {
-            var parser = new AuthTokenParser(Tokens.X5CInvalidCertificate, this.allowedClockSkew, null);
+            var parser = new AuthTokenParser(Tokens.X5CInvalidCertificate, null);
             Assert.Throws<TokenParseException>(() => parser.ParseHeaderFromTokenString());
         }
     }
diff --git a/src/WebEid.Security.Tests/Validator/AuthTokenValidationConfigurationTests.cs b/src/WebEid.Security.Tests/Validator/AuthTokenValidationConfigurationTests.cs
@@ -78,23 +78,6 @@ public void AuthTokenValidationConfigurationWithZeroOcspRequestTimeoutThrowsArgu
             }
         }
 
-        [Test]
-        public void AuthTokenValidationConfigurationWithZeroAllowedClientClockSkewThrowsArgumentOutOfRangeException()
-        {
-            using (var cache = new MemoryCache<DateTime>())
-            {
-                var configuration = new AuthTokenValidationConfiguration
-                {
-                    SiteOrigin = new Uri("https://valid", UriKind.RelativeOrAbsolute),
-                    NonceCache = cache
-                };
-                configuration.TrustedCaCertificates.Add(new X509Certificate2());
-                configuration.AllowedClientClockSkew = TimeSpan.Zero;
-                Assert.Throws<ArgumentOutOfRangeException>(() => configuration.Validate())
-                    .WithMessage("Allowed client clock skew must be greater than zero (Parameter 'duration')");
-            }
-        }
-
         [Test]
         public void AuthTokenValidationConfigurationWithCorrectDataDoesNotThrowException()
         {
@@ -122,7 +105,6 @@ public void AuthTokenValidationConfigurationCopyCopesAllData()
                     NonceCache = cache
                 };
                 configuration.OcspRequestTimeout = TimeSpan.FromMinutes(1);
-                configuration.AllowedClientClockSkew = TimeSpan.FromMinutes(1);
                 configuration.SiteCertificateSha256Fingerprint = "fingerprint";
                 configuration.TrustedCaCertificates.Add(new X509Certificate2(Certificates.GetTestEsteid2015Ca()));
                 configuration.TrustedCaCertificates.Add(new X509Certificate2(Certificates.GetTestEsteid2018Ca()));
diff --git a/src/WebEid.Security.Tests/Validator/AuthTokenValidatorClockSkewTests.cs b/src/WebEid.Security.Tests/Validator/AuthTokenValidatorClockSkewTests.cs
diff --git a/src/WebEid.Security/Validator/AuthTokenParser.cs b/src/WebEid.Security/Validator/AuthTokenParser.cs
@@ -20,20 +20,17 @@ namespace WebEid.Security.Validator
     public class AuthTokenParser
     {
         private readonly string authToken;
-        private readonly TimeSpan allowedClockSkew;
         private readonly ILogger logger;
         private IEnumerable<Claim> claims;
 
         /// <summary>
         /// Creates an instance of AuthTokenParser
         /// </summary>
         /// <param name="authToken">the Web eID authentication token with signature</param>
-        /// <param name="allowedClockSkew">the tolerated client computer clock skew when verifying the token <code>exp</code>field</param>
         /// <param name="logger">logger instance</param>
-        public AuthTokenParser(string authToken, TimeSpan allowedClockSkew, ILogger logger)
+        public AuthTokenParser(string authToken, ILogger logger)
         {
             this.authToken = authToken;
-            this.allowedClockSkew = allowedClockSkew;
             this.logger = logger;
         }
 
@@ -81,7 +78,7 @@ internal AuthTokenValidatorData ParseHeaderFromTokenString()
 
         internal void ValidateTokenSignature(X509Certificate certificate)
         {
-            ValidateTokenSignature(this.authToken, certificate, this.allowedClockSkew);
+            ValidateTokenSignature(this.authToken, certificate);
         }
 
         /// <summary>
@@ -91,8 +88,7 @@ internal void ValidateTokenSignature(X509Certificate certificate)
         /// <param name="certificate">User certificate from x5c field of JWT token</param>
         /// <param name="allowedClockSkew"></param>
         private static void ValidateTokenSignature(string authToken,
-            X509Certificate certificate,
-            TimeSpan allowedClockSkew)
+            X509Certificate certificate)
         {
             try
             {
@@ -102,18 +98,7 @@ private static void ValidateTokenSignature(string authToken,
                 // Validate only issuer signing key
                 var validationParameters = new TokenValidationParameters()
                 {
-                    ClockSkew = allowedClockSkew,
-                    ValidateLifetime = true,
-                    LifetimeValidator = (notBefore, expires, securityToken, tokenValidationParameters) =>
-                    {
-                        var clonedParameters = tokenValidationParameters.Clone();
-                        clonedParameters.LifetimeValidator = null;
-                        Microsoft.IdentityModel.Tokens.Validators.ValidateLifetime(notBefore,
-                            expires,
-                            securityToken,
-                            clonedParameters);
-                        return true;
-                    },
+                    ValidateLifetime = false,
                     ValidateAudience = false,
                     ValidateActor = false,
                     ValidateTokenReplay = false,
diff --git a/src/WebEid.Security/Validator/AuthTokenValidationConfiguration.cs b/src/WebEid.Security/Validator/AuthTokenValidationConfiguration.cs
@@ -24,7 +24,6 @@ private AuthTokenValidationConfiguration(AuthTokenValidationConfiguration other)
             this.TrustedCaCertificates = new List<X509Certificate2>(other.TrustedCaCertificates);
             this.IsUserCertificateRevocationCheckWithOcspEnabled = other.IsUserCertificateRevocationCheckWithOcspEnabled;
             this.OcspRequestTimeout = other.OcspRequestTimeout;
-            this.AllowedClientClockSkew = other.AllowedClientClockSkew;
             this.DesignatedOcspServiceConfiguration = other.DesignatedOcspServiceConfiguration;
             this.IsSiteCertificateFingerprintValidationEnabled = other.IsSiteCertificateFingerprintValidationEnabled;
             this.SiteCertificateSha256Fingerprint = other.SiteCertificateSha256Fingerprint;
@@ -42,8 +41,6 @@ private AuthTokenValidationConfiguration(AuthTokenValidationConfiguration other)
 
         public TimeSpan OcspRequestTimeout { get; set; } = TimeSpan.FromSeconds(5);
 
-        public TimeSpan AllowedClientClockSkew { get; set; } = TimeSpan.FromMinutes(3);
-
         public bool IsSiteCertificateFingerprintValidationEnabled { get; private set; }
 
         public DesignatedOcspServiceConfiguration DesignatedOcspServiceConfiguration { get; internal set; }
@@ -88,7 +85,6 @@ public void Validate()
             }
 
             RequirePositiveDuration(this.OcspRequestTimeout, "OCSP request timeout");
-            RequirePositiveDuration(this.AllowedClientClockSkew, "Allowed client clock skew");
             if (this.IsSiteCertificateFingerprintValidationEnabled && this.siteCertificateSha256Fingerprint == null)
             {
                 throw new ArgumentException("Certificate fingerprint must not be null when site certificate fingerprint validation is enabled");
@@ -124,7 +120,6 @@ public bool Equals(AuthTokenValidationConfiguration other)
                    this.IsUserCertificateRevocationCheckWithOcspEnabled.Equals(other
                        .IsUserCertificateRevocationCheckWithOcspEnabled) &&
                    this.OcspRequestTimeout.Equals(other.OcspRequestTimeout) &&
-                   this.AllowedClientClockSkew.Equals(other.AllowedClientClockSkew) &&
                    this.IsSiteCertificateFingerprintValidationEnabled.Equals(other
                        .IsSiteCertificateFingerprintValidationEnabled) &&
                    Enumerable.SequenceEqual(this.DisallowedSubjectCertificatePolicies,
diff --git a/src/WebEid.Security/Validator/AuthTokenValidator.cs b/src/WebEid.Security/Validator/AuthTokenValidator.cs
@@ -73,7 +73,7 @@ public async Task<X509Certificate> Validate(string authToken)
             try
             {
                 this.logger?.LogInformation("Starting token parsing and validation");
-                var authTokenParser = new AuthTokenParser(authToken, this.configuration.AllowedClientClockSkew, this.logger);
+                var authTokenParser = new AuthTokenParser(authToken, this.logger);
                 var actualTokenData = authTokenParser.ParseHeaderFromTokenString();
 
                 await this.simpleSubjectCertificateValidators.ExecuteFor(actualTokenData);
diff --git a/src/WebEid.Security/Validator/AuthTokenValidatorBuilder.cs b/src/WebEid.Security/Validator/AuthTokenValidatorBuilder.cs

Original file line number	Diff line number	Diff line change
`@@ -25,7 +25,6 @@ public static IAuthTokenValidator GetAuthTokenValidator(string url, ICache<DateT`
`25`	`25`	`{`
`26`	`26`	`return GetAuthTokenValidatorBuilder(url, cache, certificates)`
`27`	`27`	`// Assure that all builder methods are covered with tests.`
`28`		`- .WithAllowedClientClockSkew(TimeSpan.FromMinutes(2))`
`29`	`28`	`.WithOcspRequestTimeout(TimeSpan.FromSeconds(1))`
`30`	`29`	`.WithNonceDisabledOcspUrls(new Uri("http://example.org"))`
`31`	`30`	`.WithoutUserCertificateRevocationCheckWithOcsp()`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,5 @@`
`1`	`1`	`namespace WebEid.Security.Tests.Validator`
`2`	`2`	`{`
`3`		`- using System;`
`4`	`3`	`using Exceptions;`
`5`	`4`	`using NUnit.Framework;`
`6`	`5`	`using Security.Validator;`
`@@ -9,12 +8,10 @@ namespace WebEid.Security.Tests.Validator`
`9`	`8`	`[TestFixture]`
`10`	`9`	`public class AuthTokenParserTests`
`11`	`10`	`{`
`12`		`- private readonly TimeSpan allowedClockSkew = TimeSpan.FromMinutes(3);`
`13`		`-`
`14`	`11`	`[Test]`
`15`	`12`	`public void PopulateDataFromClaimsFillsCorrectDataAndValidationDoesNotFailFromValidToken()`
`16`	`13`	`{`
`17`		`- var parser = new AuthTokenParser(Tokens.SignedTest, this.allowedClockSkew, null);`
	`14`	`+ var parser = new AuthTokenParser(Tokens.SignedTest, null);`
`18`	`15`	`var data = parser.ParseHeaderFromTokenString();`
`19`	`16`	`parser.ParseClaims();`
`20`	`17`	`parser.PopulateDataFromClaims(data);`
`@@ -32,43 +29,43 @@ public void PopulateDataFromClaimsFillsCorrectDataAndValidationDoesNotFailFromVa`
`32`	`29`	`[Test]`
`33`	`30`	`public void ParseHeaderFromTokenStringWithMissingX5CFieldThrowsTokenParseException()`
`34`	`31`	`{`
`35`		`- var parser = new AuthTokenParser(Tokens.X5CMissing, this.allowedClockSkew, null);`
	`32`	`+ var parser = new AuthTokenParser(Tokens.X5CMissing, null);`
`36`	`33`	`Assert.Throws<TokenParseException>(() => parser.ParseHeaderFromTokenString());`
`37`	`34`	`}`
`38`	`35`
`39`	`36`	`[Test]`
`40`	`37`	`public void ParseHeaderFromTokenStringWithIncorrectX5CValueThrowsTokenParseException()`
`41`	`38`	`{`
`42`		`- var parser = new AuthTokenParser(Tokens.X5CNotString, this.allowedClockSkew, null);`
	`39`	`+ var parser = new AuthTokenParser(Tokens.X5CNotString, null);`
`43`	`40`	`Assert.Throws<TokenParseException>(() => parser.ParseHeaderFromTokenString());`
`44`	`41`	`}`
`45`	`42`
`46`	`43`	`[Test]`
`47`	`44`	`public void ParseHeaderFromTokenStringWithIncorrectX5CListValueThrowsTokenParseException()`
`48`	`45`	`{`
`49`		`- var parser = new AuthTokenParser(Tokens.X5CNotArray, this.allowedClockSkew, null);`
	`46`	`+ var parser = new AuthTokenParser(Tokens.X5CNotArray, null);`
`50`	`47`	`Assert.Throws<TokenParseException>(() => parser.ParseHeaderFromTokenString());`
`51`	`48`	`}`
`52`	`49`
`53`	`50`	`[Test]`
`54`	`51`	`public void ParseHeaderFromTokenStringWithX5CEmptyValueThrowsTokenParseException()`
`55`	`52`	`{`
`56`		`- var parser = new AuthTokenParser(Tokens.X5CEmpty, this.allowedClockSkew, null);`
	`53`	`+ var parser = new AuthTokenParser(Tokens.X5CEmpty, null);`
`57`	`54`	`Assert.Throws<TokenParseException>(() => parser.ParseHeaderFromTokenString());`
`58`	`55`	`}`
`59`	`56`
`60`	`57`	`[Test]`
`61`		`- public void ValidateRsaTokenSignatureThrowsTokenExpiredException()`
	`58`	`+ public void JwtWithoutDateFieldsDoesNotThrow()`
`62`	`59`	`{`
`63`		`- var parser = new AuthTokenParser(Tokens.TokenCertRsa, this.allowedClockSkew, null);`
	`60`	`+ var parser = new AuthTokenParser(Tokens.MinimalFormat, null);`
`64`	`61`	`var validatorData = parser.ParseHeaderFromTokenString();`
`65`		`- Assert.Throws<TokenExpiredException>(() => parser.ValidateTokenSignature(validatorData.SubjectCertificate));`
	`62`	`+ Assert.DoesNotThrow(() => parser.ValidateTokenSignature(validatorData.SubjectCertificate));`
`66`	`63`	`}`
`67`	`64`
`68`	`65`	`[Test]`
`69`	`66`	`public void ParseHeaderFromTokenStringWithInvalidX5CCertificateThrowsTokenParseException()`
`70`	`67`	`{`
`71`		`- var parser = new AuthTokenParser(Tokens.X5CInvalidCertificate, this.allowedClockSkew, null);`
	`68`	`+ var parser = new AuthTokenParser(Tokens.X5CInvalidCertificate, null);`
`72`	`69`	`Assert.Throws<TokenParseException>(() => parser.ParseHeaderFromTokenString());`
`73`	`70`	`}`
`74`	`71`	`}`
Original file line number	Diff line number	Diff line change
`@@ -73,7 +73,7 @@ public async Task<X509Certificate> Validate(string authToken)`
`73`	`73`	`try`
`74`	`74`	`{`
`75`	`75`	`this.logger?.LogInformation("Starting token parsing and validation");`
`76`		`- var authTokenParser = new AuthTokenParser(authToken, this.configuration.AllowedClientClockSkew, this.logger);`
	`76`	`+ var authTokenParser = new AuthTokenParser(authToken, this.logger);`
`77`	`77`	`var actualTokenData = authTokenParser.ParseHeaderFromTokenString();`
`78`	`78`
`79`	`79`	`await this.simpleSubjectCertificateValidators.ExecuteFor(actualTokenData);`