Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support automatic refreshing for expired OIDC tokens #2111

Closed
eugene-krivobokov opened this issue Apr 4, 2020 · 5 comments
Closed

Support automatic refreshing for expired OIDC tokens #2111

eugene-krivobokov opened this issue Apr 4, 2020 · 5 comments
Assignees

Comments

@eugene-krivobokov
Copy link

Hi!
We use oidc authentication. Our code is running inside Gradle plugin.
I've found that id-token is not refreshing automatically.
To mitigate this I've reused this mechanism from the official kubernetes client:

import io.fabric8.kubernetes.client.OAuthTokenProvider
import io.kubernetes.client.util.FilePersister
import io.kubernetes.client.util.KubeConfig

private fun oauthTokenProvider(config: File): OAuthTokenProvider {
    val kubeConfig = KubeConfig.loadKubeConfig(config.inputStream().reader())
    val persister = FilePersister(config)
    kubeConfig.setPersistConfig(persister)

    return OAuthTokenProvider { kubeConfig.accessToken }
}
Config.fromKubeconfig(kubernetesCredentials.context, configContents, "").apply {
       ...
       requestConfig.oauthTokenProvider = oauthTokenProvider(configFile)
}

https://github.com/avito-tech/avito-android/pull/297/files#diff-47071b3c0f7eebf84051f6b86e0558d9R55

Does the library support it?

@eugene-krivobokov eugene-krivobokov changed the title Support automatic refreshing OIDC tokens Support automatic refreshing for expired OIDC tokens Apr 4, 2020
@rohanKanojia
Copy link
Member

@eugene-krivobokov: Hi, Thanks a lot for your bug report. I'm not sure if our library supports this as of now. I think we should try to integrate it as it seems to be a very common use case. @oscerd @manusa @iocanel WDYT??

@stale
Copy link

stale bot commented Jul 4, 2020

This issue has been automatically marked as stale because it has not had any activity since 90 days. It will be closed if no further activity occurs within 7 days. Thank you for your contributions!

@holdenk
Copy link

holdenk commented Aug 21, 2020

This is something that's impacting the Spark project.

@rohanKanojia
Copy link
Member

We will prioritize this in upcoming sprint

@holdenk
Copy link

holdenk commented Aug 21, 2020

Great, thank you :)

@manusa manusa mentioned this issue Aug 25, 2020
@rohanKanojia rohanKanojia self-assigned this Aug 27, 2020
rohanKanojia added a commit to rohanKanojia/kubernetes-client that referenced this issue Aug 28, 2020
rohanKanojia added a commit to rohanKanojia/kubernetes-client that referenced this issue Aug 31, 2020
rohanKanojia added a commit to rohanKanojia/kubernetes-client that referenced this issue Sep 1, 2020
rohanKanojia added a commit to rohanKanojia/kubernetes-client that referenced this issue Sep 1, 2020
rohanKanojia added a commit to rohanKanojia/kubernetes-client that referenced this issue Sep 1, 2020
rohanKanojia added a commit to rohanKanojia/kubernetes-client that referenced this issue Sep 1, 2020
rohanKanojia added a commit to rohanKanojia/kubernetes-client that referenced this issue Sep 1, 2020
rohanKanojia added a commit to rohanKanojia/kubernetes-client that referenced this issue Sep 1, 2020
rohanKanojia added a commit to rohanKanojia/kubernetes-client that referenced this issue Sep 2, 2020
rohanKanojia added a commit to rohanKanojia/kubernetes-client that referenced this issue Sep 2, 2020
rohanKanojia added a commit to rohanKanojia/kubernetes-client that referenced this issue Sep 2, 2020
- Added OIDCTokenRefreshInterceptor which would try to refresh token
  in case 401 is received.
- OpenIDConnectionUtils would refresh token using two HTTP requests
  - first client tries to get OpenID provider discovery document at
    [[.issuer-url]]/.well-known/openid-configuration and gets token_endpoint
  - Then client does a POST request to token_endpoint with all the required
    parameters(refresh_token, client_id, client_secret etc)
rohanKanojia added a commit to rohanKanojia/kubernetes-client that referenced this issue Sep 2, 2020
- Added OIDCTokenRefreshInterceptor which would try to refresh token
  in case 401 is received.
- OpenIDConnectionUtils would refresh token using two HTTP requests
  - first client tries to get OpenID provider discovery document at
    [[.issuer-url]]/.well-known/openid-configuration and gets token_endpoint
  - Then client does a POST request to token_endpoint with all the required
    parameters(refresh_token, client_id, client_secret etc)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants