V14: Apply sliding window token expiry based on the configured max login lifetime

[elit0451]

Details

Caution

> The client application needs to make some changes before we merge this PR, as there is a minimum access token lifetime set to 10mins by the library they use, which is not the case with the default 20mins timeout that we support (making it only 5mins for the access token).

• Reimplementing session timeout which will prompt the user for re-authentication when the time has passed.
  • Making use of sliding window expiry for access and refresh token - where the access token has 4 times shorter lifetime than the refresh token which will make the client application re-request a new access token behind the scenes using the refresh token;
  • Only after the refresh token expires, the user will have to re-authenticate.

Test

• To see the expiration take effect faster, let's change the value of Umbraco::CMS::Global::TimeOut to 00:04::00;
  • This will set the refresh token lifetime to 4 mins and the access token to 1m (25% of 4mins);
• Using Postman:
  • Get a token (through /umbraco/management/api/v1/security/back-office/authorize and then /umbraco/management/api/v1/security/back-office/token);
    • Tip: Use ?&scope=offline_access to make sure you get a refresh token from the /token endpoint.
• Verify that the value of "expires_in": 59, or 60 (seconds);
• Verify that you can use the access token in a Management API endpoint;
• Verify that you cannot use the access token in a Management API endpoint after 1 min;
• Verify that you can get a new access token, using the refresh token as it will still be vaild;
• Verify that if you don't use the refresh token for 4mins - it will be invalid when trying to get a new token after 4mins have passed;
• Verify that if you change the value of Umbraco::CMS::Global::TimeOut setting, the value of the "expires_in" parameter from the response of /umbraco/management/api/v1/security/back-office/token endpoint also changes accordingly.

Note

We can go over the test scenarios together if something doesn't make sense 😉

[kjac]

Works great! Code looks fine too. I updated the comment to add a little more clarity when we re-read it in the future :)