Merge branch '292-float-iat' into 'main'

Support for sub-second precision in JWT iat claim

Closes #292

See merge request yaal/canaille!286

Author: azmeuk

CHANGES.rst

@@ -6,6 +6,11 @@ Fixed
 - JWK algorithm detection with OKP keys.
 - OIDC Client ``acess_token`` and ``refresh_token`` are unique in the SQL backend.
 
+Added
+^^^^^
+- OIDC ``iat`` claims are now float, with milli/micro-second precision. :issue:`292`
+- LDAP dates are stored with milliseconds precision and timezones.
+
 [0.0.80] - 2025-08-22
 ---------------------
 

canaille/backends/ldap/utils.py

@@ -43,7 +43,8 @@ def ldap_to_python(value, syntax):
             return datetime.datetime.strptime(value, format_string).replace(
                 tzinfo=datetime.timezone.utc
             )
-        return datetime.datetime.strptime(value, "%Y%m%d%H%M%S%z")
+        format_string = "%Y%m%d%H%M%S.%f%z" if "." in value else "%Y%m%d%H%M%S%z"
+        return datetime.datetime.strptime(value, format_string)
 
     if syntax == Syntax.INTEGER:
         return int(value.decode("utf-8"))
@@ -66,9 +67,9 @@ def python_to_ldap(value, syntax, encode=True):
         if value == datetime.datetime.min:
             value = LDAP_NULL_DATE
         elif not value.tzinfo or value.tzinfo == datetime.timezone.utc:
-            value = value.strftime("%Y%m%d%H%M%SZ")
+            value = value.strftime("%Y%m%d%H%M%S.%fZ")
         else:
-            value = value.strftime("%Y%m%d%H%M%S%z")
+            value = value.strftime("%Y%m%d%H%M%S.%f%z")
 
     if syntax == Syntax.INTEGER and isinstance(value, int):
         value = str(value)

canaille/oidc/models.py

@@ -160,7 +160,7 @@ def is_expired(self):
             seconds=int(self.lifetime)
         ) < datetime.datetime.now(datetime.timezone.utc)
 
-    def get_auth_time(self) -> int | None:
+    def get_auth_time(self) -> float | None:
         return self.auth_time.timestamp() if self.auth_time else None
 
     def get_acr(self):
@@ -173,7 +173,7 @@ def get_amr(self):
 class Token(BaseToken, TokenMixin):
     @property
     def expire_date(self):
-        return self.issue_date + datetime.timedelta(seconds=int(self.lifetime))
+        return self.issue_date + datetime.timedelta(seconds=self.lifetime)
 
     @property
     def revoked(self):
@@ -182,11 +182,11 @@ def revoked(self):
     def get_scope(self):
         return " ".join(self.scope)
 
-    def get_issued_at(self) -> int:
-        return int(self.issue_date.timestamp())
+    def get_issued_at(self) -> float:
+        return self.issue_date.timestamp()
 
-    def get_expires_at(self) -> int:
-        return self.get_issued_at() + int(self.lifetime)
+    def get_expires_at(self) -> float:
+        return self.get_issued_at() + self.lifetime
 
     def is_refresh_token_active(self):
         if self.revokation_date:

tests/backends/ldap/test_utils.py

@@ -104,7 +104,7 @@ def test_ldap_to_python():
             datetime.datetime(2000, 1, 2, 3, 4, 5, tzinfo=datetime.timezone.utc),
             Syntax.GENERALIZED_TIME,
         )
-        == b"20000102030405Z"
+        == b"20000102030405.000000Z"
     )
     assert (
         python_to_ldap(
@@ -119,7 +119,7 @@ def test_ldap_to_python():
             ),
             Syntax.GENERALIZED_TIME,
         )
-        == b"20000102030405-0200"
+        == b"20000102030405.000000-0200"
     )
     assert (
         python_to_ldap(datetime.datetime.min, Syntax.GENERALIZED_TIME)