apache/dolphinscheduler · error · ServiceException

OIDC_ID_TOKEN_EXPIRED

OIDC_ID_TOKEN_EXPIRED

Error message

OIDC_ID_TOKEN_EXPIRED

What it means

validateIdToken reads the exp claim and throws ServiceException(Status.OIDC_ID_TOKEN_EXPIRED) when the expiration time is null or already in the past. ID tokens are short-lived (typically minutes); this error means the token can no longer be trusted for login because its validity window has ended.

Source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/security/impl/oidc/OidcAuthenticator.java:293

        try {
            claimsSet = idToken.getJWTClaimsSet();
        } catch (java.text.ParseException e) {
            throw new ServiceException("Error parsing ID token claims", e);
        }

        String issuer = claimsSet.getIssuer();
        if (issuer == null || !issuer.equals(providerMetadata.getIssuer().getValue())) {
            throw new ServiceException(Status.OIDC_ID_TOKEN_ISSUER_INVALID);
        }

        List<String> audiences = claimsSet.getAudience();
        if (audiences == null || !audiences.contains(providerConfig.getClientId())) {
            throw new ServiceException(Status.OIDC_ID_TOKEN_AUDIENCE_INVALID);
        }

        Date expirationTime = claimsSet.getExpirationTime();
        if (expirationTime == null || expirationTime.before(new Date())) {
            throw new ServiceException(Status.OIDC_ID_TOKEN_EXPIRED);
        }

        try {
            return new IDTokenClaimsSet(claimsSet);
        } catch (ParseException e) {
            log.error("Failed to parse ID token claims, required claims may be missing.", e);
            throw new ServiceException("ID token is missing required claims", e);
        }
    }

    /**
     * Get user info from UserInfo endpoint
     */
    private UserInfo getUserInfo(OIDCProviderMetadata providerMetadata, AccessToken accessToken) throws Exception {
        UserInfoRequest userInfoRequest = new UserInfoRequest(
                providerMetadata.getUserInfoEndpointURI(),
                accessToken);

View on GitHub (pinned to 02eac45a1b)

Solutions

1. Restart the login flow to obtain a fresh ID token instead of reusing the old one.
2. Sync the server clock (NTP) on the DolphinScheduler host; clock skew makes freshly issued tokens appear expired.
3. Check the IdP's token lifetime settings and increase them only if login flows legitimately take longer than the lifetime.
4. Make sure the authorization-code exchange happens immediately in the callback and is not retried with cached responses.

Example fix

// before: reusing a stored id_token from a previous session
JWT idToken = cachedIdToken; // exp already passed

// after: always exchange the fresh authorization code
OIDCTokenResponse resp = tokenRequest(authorizationCode);
JWT idToken = resp.getOIDCTokens().getIDToken();

// check expiry client-side before calling validation
Date exp = decoded.getExpirationTime();
if (exp == null || exp.before(new Date())) {
    throw new IllegalStateException("ID token already expired, restart login");
}

boolean isUsable(JWTClaimsSet c) {
    try { Date e = c.getExpirationTime(); return e != null && e.after(new Date()); }
    catch (java.text.ParseException ex) { return false; }
}

try {
    return idTokenClaims(providerMetadata, providerConfig, idToken);
} catch (ServiceException e) {
    // expired token: restart the auth flow for a fresh one
    return initiateNewAuthorizationRequest();
}

When it happens

Trigger: idTokenClaims -> validateIdToken with an ID token whose exp claim is missing or whose exp < now — e.g. finishing the OAuth callback after the token expired, clock skew between server and IdP, or replaying a captured token long after issuance.

Common situations: User sat on the login redirect page longer than the token lifetime; large clock drift between the DolphinScheduler host and the identity provider; authorization-code exchange retried with a cached/stale id_token; debugging with an old token copied from logs.

Related errors

• Error parsing ID token claims
• OIDC_ID_TOKEN_ISSUER_INVALID
• OIDC_ID_TOKEN_AUDIENCE_INVALID
• ID token is missing required claims
• OIDC_TOKEN_EXCHANGE_FAILED

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/aa3e76ac73b9b938. Report an issue: GitHub.