'How is expiry information guaranteed in OAuth 2.0?
I'm using Keycloaks OAuth2.0 feature to authenticate my demo application and I wanna know a few things regarding the validity of JWT generated by Keycloak.
Premise: Say I have ant act-act set up of an OAuth 2.0 Authorization server. Both servers share the same database, therefore they can validate JWTs generated by the other act server (both share the same info, thus they both have the same secret key), along with JWTs generated by themselves.
Machine 1 ACT Server A : Can validate JWTs generated by Server A and Server B
Machine 2 ACT Server B : Can validate JWTs generated by Server B and Server A
Machine 3 Database : Referenced by Server A and Server B
Question: If system time aren't synchronized between Server A and Server B, how does OAuth2.0 guarantee the validity of a token? Example below
Say , Token expiry is 1 hour and the process below are simultaneously done.
Machine 1 ACT Server A (system time : 13:00) - generates TOKEN_A with an expiry of 14:00
Machine 2 ACT Server B (system time : 14:10) - validates TOKEN_A
RESULT : ??????
Does Server B consider TOKEN_A as an expired token, while Server A considers it a live token?
P.S If possible, I would like an official citation (manual or something) to the answer.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|