{"record":{"id":"226609412e8d232e","repo":"theonedev/onedev","slug":"id-token-was-expired","errorCode":null,"errorMessage":"ID token was expired","messagePattern":"ID token was expired","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"server-plugin/server-plugin-sso-openid/src/main/java/io/onedev/server/plugin/sso/openid/OpenIdConnector.java","lineNumber":228,"sourceCode":"\t\t\treturn null;\n\t\t}\n\t}\n\t\n\tprotected SsoAuthenticated processTokenResponse(OIDCTokenResponse tokenResponse) {\n\t\ttry {\n\t\t\tJWT idToken = tokenResponse.getOIDCTokens().getIDToken();\n\t\t\tJWTClaimsSet claims = idToken.getJWTClaimsSet();\n\t\t\t\n\t\t\tif (!claims.getIssuer().equals(getCachedProviderMetadata().getIssuer()))\n\t\t\t\tthrow new AuthenticationException(_T(\"Inconsistent issuer in provider metadata and ID token\"));\n\t\t\t\n\t\t\tDateTime now = new DateTime();\n\t\t\t\n\t\t\tif (claims.getIssueTime() != null && claims.getIssueTime().after(now.plusSeconds(10).toDate()))\n\t\t\t\tthrow new AuthenticationException(_T(\"Invalid issue date of ID token\"));\n\t\t\t\n\t\t\tif (claims.getExpirationTime() != null && now.toDate().after(claims.getExpirationTime()))\n\t\t\t\tthrow new AuthenticationException(_T(\"ID token was expired\"));\n\n\t\t\tSession.get().setAttribute(SESSION_ATTR_ID_TOKEN, idToken.serialize());\n\n\t\t\tString subject = claims.getSubject();\n\t\t\tString email = StringUtils.trimToNull(claims.getStringClaim(\"email\"));\n\n\t\t\tBoolean emailVerified = claims.getBooleanClaim(\"email_verified\");\n\t\t\tif (emailVerified == null)\n\t\t\t\temailVerified = claims.getBooleanClaim(\"emailVerified\");\n\t\t\tif (emailVerified != null && !emailVerified)\n\t\t\t\temail = null;\n\n\t\t\tString userName = StringUtils.trimToNull(claims.getStringClaim(\"preferred_username\"));\n\t\t\tString fullName = StringUtils.trimToNull(claims.getStringClaim(\"name\"));\n\t\t\tList<String> groups;\n\t\t\tif (getGroupsClaim() != null) {\n\t\t\t\tvar groupsArray = claims.getStringArrayClaim(getGroupsClaim());\n\t\t\t\tif (groupsArray != null)","sourceCodeStart":210,"sourceCodeEnd":246,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-sso-openid/src/main/java/io/onedev/server/plugin/sso/openid/OpenIdConnector.java#L210-L246","documentation":"Thrown by OpenIdConnector.processTokenResponse when the ID token's exp (expiration) claim exists and is already in the past at validation time. The connector rejects expired tokens rather than trusting an authentication that is no longer valid.","triggerScenarios":"The token response reaches processTokenResponse after the ID token's exp time has passed — long delay between the provider issuing the token and the code-exchange/validation step, or a token with a very short expiry combined with clock skew.","commonSituations":"Severe OneDev server clock skew making a valid token look expired; extremely short token lifetime configured on the provider; slow networks or stalled token endpoint calls exceeding token TTL; reusing an old authorization code whose token expired.","solutions":["Synchronize the OneDev server clock with NTP, then retry the login.","Retry the SSO login to obtain a fresh token promptly after redirect.","Increase the ID token lifetime on the identity provider if it expires before the exchange completes.","Investigate slow token endpoint responses (network latency to the provider) that delay validation past exp."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    auth = connector.handleAuthResponse(...);\n} catch (AuthenticationException e) {\n    if (e.getMessage().contains(\"ID token was expired\")) {\n        // sync clocks if skewed, then retry login to get a fresh token\n    }\n}","preventionTips":["Keep server clocks NTP-synchronized.","Set a reasonable ID token lifetime on the provider (not a few seconds).","Complete the OAuth redirect promptly; investigate slow token endpoint calls.","Avoid replaying old authorization codes."],"tags":["oidc","sso","token-expired","clock-skew"],"backgroundTag":"jwt-token-expired","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}