OAuth2 different token expiration time per client

I am using spring-security-oauth2 to implement my OAuth2 Authorization server. spring-security-oauth2 is going away and I understand I need to replace it with spring-authorization-server

Question: Is it possible to have different token-expiry-time for different clients (here client represents client-id/client-secret pair)?

If Yes, can you please share documentation/sample code around spring-authorization-server?

If no, is it a limitation of spring-authorization-server OR it is not allowed by OAuth2 spec?

(To clarify, I am NOT saying that it was possible in spring-security-oauth2, if it was I would like to know as well)

Solution 1:

Yes, you can have different expiration times per client. You would use the tokenSettings of each RegisteredClient, as in the following example:

RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
                .clientId("messaging-client")
                .clientSecret("{noop}secret")
                .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
                .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
                .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
                .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
                .redirectUri("http://127.0.0.1:8080/login/oauth2/code/messaging-client-oidc")
                .redirectUri("http://127.0.0.1:8080/authorized")
                .scope(OidcScopes.OPENID)
                .scope("message.read")
                .scope("message.write")
                .tokenSettings(TokenSettings.builder()
                        .accessTokenTimeToLive(Duration.ofMinutes(5))
                        .refreshTokenTimeToLive(Duration.ofHours(2))
                        .build())
                .clientSettings(ClientSettings.builder().requireAuthorizationConsent(true).build())
                .build();

See the sample config for full context.