SDKS-5120: Allow configurable authenticationValidityDuration in DeviceBindingCallback and DeviceSigningVerifierCallback

Author: vibhorgoswami

CHANGELOG.md

@@ -1,3 +1,8 @@
+## [4.8.6]
+
+#### Added
+- Added `authenticationValidityDuration` property to `DeviceBindingCallback` and `DeviceSigningVerifierCallback`, allowing callers to control the duration (in seconds) for which a generated key remains valid for user authentication. Defaults to `5` seconds.
+
 ## [4.8.5]
 
 #### Fixed

forgerock-auth/src/main/java/org/forgerock/android/auth/callback/DeviceBindingCallback.kt

@@ -104,6 +104,12 @@ open class DeviceBindingCallback : AbstractCallback, Binding {
     lateinit var attestation: Attestation
         private set
 
+    /**
+     * The duration (in seconds) for which the generated key remains valid for user authentication.
+     * Passed to [CryptoKey] during key generation. Defaults to 5 seconds.
+     */
+    var authenticationValidityDuration: Int = 5
+
     init {
         //If attestation is not provided, default to NONE
         if (!::attestation.isInitialized) {
@@ -222,7 +228,7 @@ open class DeviceBindingCallback : AbstractCallback, Binding {
                                      .build().identifier,
                                  prompt: Prompt? = null) {
 
-        deviceAuthenticator.initialize(userId, prompt ?: Prompt(title, subtitle, description))
+        deviceAuthenticator.initialize(userId, authenticationValidityDuration, prompt ?: Prompt(title, subtitle, description))
 
         if (deviceAuthenticator.isSupported(context, attestation).not()) {
             handleException(DeviceBindingException(Unsupported()))

forgerock-auth/src/main/java/org/forgerock/android/auth/callback/DeviceSigningVerifierCallback.kt

@@ -114,6 +114,12 @@ open class DeviceSigningVerifierCallback : AbstractCallback, Binding {
         super.setValue(clientError, 1)
     }
 
+    /**
+     * The duration (in seconds) for which the generated key remains valid for user authentication.
+     * Passed to the underlying crypto key during key generation. Defaults to 5 seconds.
+     */
+    var authenticationValidityDuration: Int = 5
+
     /**
      * Sign the challenge with bounded device keys.
      *
@@ -178,7 +184,7 @@ open class DeviceSigningVerifierCallback : AbstractCallback, Binding {
                                             customClaims: Map<String, Any> = emptyMap(),
                                             prompt: Prompt? = null) {
 
-        deviceAuthenticator.initialize(userKey.userId, prompt?: Prompt(title, subtitle, description))
+        deviceAuthenticator.initialize(userKey.userId, authenticationValidityDuration, prompt?: Prompt(title, subtitle, description))
 
         if (deviceAuthenticator.isSupported(context).not()) {
             handleException(DeviceBindingException(Unsupported()))

forgerock-auth/src/main/java/org/forgerock/android/auth/devicebind/DeviceBindAuthenticators.kt

@@ -72,7 +72,10 @@ interface DeviceAuthenticator {
      * @param kid Generated kid from the Preference
      * @param userId userId received from server
      * @param challenge challenge received from server
-     * @param customClaims A map of custom claims to be added to the jws payload
+     * @param expiration token expiration time
+     * @param attestation Attestation type to decide whether to include certificate chain in the JWS header
+     *
+     * @return the signed JWT as String
      */
     fun sign(context: Context,
              keyPair: KeyPair,
@@ -89,7 +92,7 @@ interface DeviceAuthenticator {
         if (attestation !is Attestation.None) {
             builder.x509CertChain(getCertificateChain(userId))
         }
-        val jwk = builder.build();
+        val jwk = builder.build()
         val signedJWT = SignedJWT(JWSHeader.Builder(parse(getAlgorithm()))
             .keyID(kid).jwk(jwk).build(),
             JWTClaimsSet.Builder().subject(userId)
@@ -210,7 +213,7 @@ interface DeviceAuthenticator {
 
 }
 
-fun DeviceAuthenticator.initialize(userId: String, prompt: Prompt): DeviceAuthenticator {
+fun DeviceAuthenticator.initialize(userId: String, authenticationValidityDuration: Int,  prompt: Prompt): DeviceAuthenticator {
 
     //Inject objects
     if (this is BiometricAuthenticator) {
@@ -219,15 +222,15 @@ fun DeviceAuthenticator.initialize(userId: String, prompt: Prompt): DeviceAuthen
             prompt.description,
             deviceBindAuthenticationType = this.type()))
     }
-    initialize(userId)
+    initialize(userId, authenticationValidityDuration)
     this.prompt(prompt)
     return this
 }
 
-fun DeviceAuthenticator.initialize(userId: String): DeviceAuthenticator {
+fun DeviceAuthenticator.initialize(userId: String, authenticationValidityDuration: Int = 5): DeviceAuthenticator {
     //Inject objects
     if (this is CryptoAware) {
-        this.setKey(CryptoKey(userId))
+        this.setKey(CryptoKey(userId, authenticationValidityDuration))
     }
     return this
 }