feat: add possibility to ignore missing "exp" claim in introspection

[buehler]

Hey there!

I'm currently having an issue with an identity provider that does not return the "exp" claim in the introspection response. Since the "exp" claim is not required by the RFC, this may happen to other identity providers.

This option should allow a configuration to ignore the fact that the exp claim is missing.

Then, the default duration is used.

[leastprivilege]

Thanks! We will look into it.

[buehler]

ping @leastprivilege :-)

[leastprivilege]

@brockallen Could you review?

Not sure we need an additional option - if no exp claim is present, the default cache duration could be used?!

[brockallen]

Not sure we need an additional option - if no exp claim is present, the default cache duration could be used?!

Which default cache duration? Of the cache implementation itself?

[leastprivilege]

https://github.com/IdentityModel/IdentityModel.AspNetCore.OAuth2Introspection/blob/main/src/OAuth2IntrospectionOptions.cs#L109

[brockallen]

Ok, missed that... so yea, agreed on:

Not sure we need an additional option - if no exp claim is present, the default cache duration could be used?!

[buehler]

Hey @brockallen, @leastprivilege

I changed the logic according to your comments. I removed the additional options field and "just" removed the expClaim null check. Now if there is no exp claim, the passed duration TimeSpan is used.