authn: Support IdPs that backdate their "iat" claim in id tokens

The backdating must be a fixed duration, which is what I've observed
with Azure AD (300s) and other IdPs.  Backdating is sometimes applied to
be more lenient with clients that have a slow clock (i.e. who otherwise
might see a correct iat as in the future and reject the token).

Without accounting for backdating, our staleBefore marker can cause a
temporary deauthentication and repeated renewal attempts as token
renewal requests "work" but produce a token with an iat that's still
older than the staleBefore.

src/authn/index.js

@@ -19,7 +19,7 @@ import { JOSEError, JWTClaimValidationFailed, JWTExpired } from 'jose/util/error
 import partition from 'lodash.partition';
 import BearerStrategy from './bearer.js';
 import { getTokens, setTokens, deleteTokens } from './session.js';
-import { PRODUCTION, OIDC_ISSUER_URL, OIDC_JWKS_URL, OAUTH2_AUTHORIZATION_URL, OAUTH2_TOKEN_URL, OAUTH2_LOGOUT_URL, OAUTH2_SCOPES_SUPPORTED, OIDC_USERNAME_CLAIM, OIDC_GROUPS_CLAIM, OAUTH2_CLIENT_ID, OAUTH2_CLIENT_SECRET, OAUTH2_CLI_CLIENT_ID } from '../config.js';
+import { PRODUCTION, OIDC_ISSUER_URL, OIDC_JWKS_URL, OAUTH2_AUTHORIZATION_URL, OAUTH2_TOKEN_URL, OAUTH2_LOGOUT_URL, OAUTH2_SCOPES_SUPPORTED, OIDC_USERNAME_CLAIM, OIDC_GROUPS_CLAIM, OIDC_IAT_BACKDATED_BY, OAUTH2_CLIENT_ID, OAUTH2_CLIENT_SECRET, OAUTH2_CLI_CLIENT_ID } from '../config.js';
 import { AuthnRefreshTokenInvalid, AuthnTokenTooOld } from '../exceptions.js';
 import { fetch } from '../fetch.js';
 import { copyCookie } from '../middleware.js';
@@ -716,8 +716,8 @@ async function verifyIdToken(idToken, client = OAUTH2_CLIENT_ID) {
     if (typeof claims.iat !== "number") {
       throw new JWTClaimValidationFailed(`"iat" claim must be a number`, "iat", "invalid");
     }
-    if (claims.iat < staleBefore) {
-      throw new AuthnTokenTooOld(`"iat" claim less than user's staleBefore: ${claims.iat} < ${staleBefore}`);
+    if (claims.iat + OIDC_IAT_BACKDATED_BY < staleBefore) {
+      throw new AuthnTokenTooOld(`"iat" claim (plus any backdating) less than user's staleBefore: ${claims.iat} + ${OIDC_IAT_BACKDATED_BY} < ${staleBefore}`);
     }
   }
 

src/config.js

@@ -200,6 +200,19 @@ export const OIDC_USERNAME_CLAIM = fromEnvOrConfig("OIDC_USERNAME_CLAIM");
 export const OIDC_GROUPS_CLAIM = fromEnvOrConfig("OIDC_GROUPS_CLAIM");
 
 
+/**
+ * Fixed time (in seconds) by which the IdP backdates the "iat" claim of the ID
+ * token.
+ *
+ * @type {number}
+ */
+export const OIDC_IAT_BACKDATED_BY = fromEnvOrConfig("OIDC_IAT_BACKDATED_BY", 0);
+
+if (typeof OIDC_IAT_BACKDATED_BY !== 'number') {
+  throw new Error(`OIDC_IAT_BACKDATED_BY value is not a number; got "${OIDC_IAT_BACKDATED_BY}"`);
+}
+
+
 /**
  * Path to a JSON file containing Groups data.
  *