Persist refreshed tokens #408
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
When the authorization server rotates key IDs, we might encounter a token with a kid which the server no longer reports in discovery. Currently, json-jwt raises an exception and the user must expend a lot of effort debugging. We can help by simply assuming the token is expired and forcing token refresh.
This allows consumers to get access to the new refresh token when the ID token is refreshed. This is important because refresh tokens are single-use. If the consumer code needs to refresh the ID token a second time, it will need to use an updated refresh token.
In case the ID token is refreshed, client code will also need to know the new refresh token in order to pass it forward.
|
Friendly ping 👋, as #407 has been merged, would you like to rebase and advance this? AFAICT, this prepares some APIs but doesn't yet write back a kubeconfig file, right? |
|
BTW, preparing some APIs can be a great stand-alone PR 👍, not saying you have to do it all at once. |
|
Do'h I finally get it. Currently, (once
As I now mentioned on #606, need to find right place where to save it... current README advice to renew auth by re-creating all objects, even the |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See #409
This is based on #407, and should be rebased once that is merged.