From 4bb8b137f09219ecc7fbc81a25a3079140745b7e Mon Sep 17 00:00:00 2001
From: Matt Gilman <matt.c.gilman@gmail.com>
Date: Tue, 17 Nov 2015 18:58:22 -0500
Subject: [PATCH] NIFI-655: - Keeping token expiration between 1 minute and 12
 hours.

---
 .../apache/nifi/web/api/AccessResource.java   | 20 +++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/AccessResource.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/AccessResource.java
index 67eb8b4c66..57de41d6aa 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/AccessResource.java
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/AccessResource.java
@@ -33,6 +33,7 @@ import java.net.URI;
 import java.security.cert.X509Certificate;
 import java.util.Arrays;
 import java.util.List;
+import java.util.concurrent.TimeUnit;
 import javax.servlet.http.HttpServletRequest;
 import javax.ws.rs.DefaultValue;
 import javax.ws.rs.FormParam;
@@ -316,9 +317,24 @@ public class AccessResource extends ApplicationResource {
             try {
                 // attempt to authenticate
                 final AuthenticationResponse authenticationResponse = loginIdentityProvider.authenticate(new LoginCredentials(username, password));
-
+                final long maxExpiration = TimeUnit.MILLISECONDS.convert(12, TimeUnit.HOURS);
+                final long minExpiration = TimeUnit.MILLISECONDS.convert(1, TimeUnit.MINUTES);
+                
+                long expiration = authenticationResponse.getExpiration();
+                if (expiration > maxExpiration) {
+                    expiration = maxExpiration;
+                    
+                    logger.warn(String.format("Max token expiration exceeded. Setting expiration to %s from %s for %s", expiration, 
+                            authenticationResponse.getExpiration(), authenticationResponse.getIdentity()));
+                } else if (expiration < minExpiration) {
+                    expiration = minExpiration;
+                    
+                    logger.warn(String.format("Min token expiration not met. Setting expiration to %s from %s for %s", expiration, 
+                            authenticationResponse.getExpiration(), authenticationResponse.getIdentity()));
+                }
+                
                 // create the authentication token
-                loginAuthenticationToken = new LoginAuthenticationToken(authenticationResponse.getUsername(), authenticationResponse.getExpiration());
+                loginAuthenticationToken = new LoginAuthenticationToken(authenticationResponse.getUsername(), expiration);
             } catch (final InvalidLoginCredentialsException ilce) {
                 throw new IllegalArgumentException("The supplied username and password are not valid.", ilce);
             } catch (final IdentityAccessException iae) {