{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/fxa-oauth-server/issues/181","labels_url":"https://api.github.com/repos/mozilla/fxa-oauth-server/issues/181/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/fxa-oauth-server/issues/181/comments","events_url":"https://api.github.com/repos/mozilla/fxa-oauth-server/issues/181/events","html_url":"https://github.com/mozilla/fxa-oauth-server/issues/181","id":51161628,"number":181,"title":"Provide a mechanism for reliers to learn when the user last authenticated with the auth server","user":{"login":"ckarlof","id":2365255,"avatar_url":"https://avatars.githubusercontent.com/u/2365255?v=3","gravatar_id":"","url":"https://api.github.com/users/ckarlof","html_url":"https://github.com/ckarlof","followers_url":"https://api.github.com/users/ckarlof/followers","following_url":"https://api.github.com/users/ckarlof/following{/other_user}","gists_url":"https://api.github.com/users/ckarlof/gists{/gist_id}","starred_url":"https://api.github.com/users/ckarlof/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ckarlof/subscriptions","organizations_url":"https://api.github.com/users/ckarlof/orgs","repos_url":"https://api.github.com/users/ckarlof/repos","events_url":"https://api.github.com/users/ckarlof/events{/privacy}","received_events_url":"https://api.github.com/users/ckarlof/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/mozilla/fxa-oauth-server/labels/waffle%3Aready","name":"waffle:ready","color":"ededed"}],"state":"open","locked":false,"assignee":{"login":"rfk","id":34695,"avatar_url":"https://avatars.githubusercontent.com/u/34695?v=3","gravatar_id":"","url":"https://api.github.com/users/rfk","html_url":"https://github.com/rfk","followers_url":"https://api.github.com/users/rfk/followers","following_url":"https://api.github.com/users/rfk/following{/other_user}","gists_url":"https://api.github.com/users/rfk/gists{/gist_id}","starred_url":"https://api.github.com/users/rfk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfk/subscriptions","organizations_url":"https://api.github.com/users/rfk/orgs","repos_url":"https://api.github.com/users/rfk/repos","events_url":"https://api.github.com/users/rfk/events{/privacy}","received_events_url":"https://api.github.com/users/rfk/received_events","type":"User","site_admin":false},"milestone":null,"comments":7,"created_at":"2014-12-06T00:12:29Z","updated_at":"2015-01-23T00:12:33Z","closed_at":null,"body":"Some reliers need to know at what time the user last successfully entered her password. E.g., if a user on Marketplace enters her purchase PIN incorrectly too many times in a row, they force her to re-enter her password to reset the PIN. This \"last authentication time\" needs to be communicated to Marketplace in some manner (https://bugzilla.mozilla.org/show_bug.cgi?id=1104304). \r\n\r\nLuckily, the FxA auth server includes this time in signed certs (https://github.com/mozilla/fxa-auth-server/blob/master/docs/api.md#response-12). \r\n\r\nIt's not clear what is the best way to communicate it to Marketplace, but a simple one would be to return the `authAt` value in the [the response from the OAuth server when the relier exchanges a code for a token](https://github.com/mozilla/fxa-oauth-server/blob/master/docs/api.md#post-v1token). \r\n\r\n**Include the time in the response when  https://github.com/mozilla/fxa-oauth-server/blob/master/docs/api.md#post-v1token"},"comment":{"url":"https://api.github.com/repos/mozilla/fxa-oauth-server/issues/comments/71125833","html_url":"https://github.com/mozilla/fxa-oauth-server/issues/181#issuecomment-71125833","issue_url":"https://api.github.com/repos/mozilla/fxa-oauth-server/issues/181","id":71125833,"user":{"login":"seanmonstar","id":51479,"avatar_url":"https://avatars.githubusercontent.com/u/51479?v=3","gravatar_id":"","url":"https://api.github.com/users/seanmonstar","html_url":"https://github.com/seanmonstar","followers_url":"https://api.github.com/users/seanmonstar/followers","following_url":"https://api.github.com/users/seanmonstar/following{/other_user}","gists_url":"https://api.github.com/users/seanmonstar/gists{/gist_id}","starred_url":"https://api.github.com/users/seanmonstar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/seanmonstar/subscriptions","organizations_url":"https://api.github.com/users/seanmonstar/orgs","repos_url":"https://api.github.com/users/seanmonstar/repos","events_url":"https://api.github.com/users/seanmonstar/events{/privacy}","received_events_url":"https://api.github.com/users/seanmonstar/received_events","type":"User","site_admin":false},"created_at":"2015-01-23T00:12:33Z","updated_at":"2015-01-23T00:12:33Z","body":"@ckarlof so, if we record the timestamp when we generate a token to give to Marketplace, that won't necessarily stay updated. They could sign into Markplace on Jan 1, and that's the time we would record. Perhaps Jan 20th, they did an action needing a re-auth, and Marketplace asks us the lastAuthAt value, we'd say Jan 1. Even if the user happily logged in and fiddled with their avatar earlier that day."}}