Method handleOIDCRefresh

rest/oidc_api.go:215–264

()

}

func (h *handler) handleOIDCRefresh() error {
	refreshToken := h.getQuery(requestParamRefreshToken)
	if refreshToken == "" {
		return base.NewHTTPError(http.StatusBadRequest, "Refresh token must be present for oidc refresh")
	}

	providerName := h.getQuery(requestParamProvider)
	provider, err := h.getOIDCProvider(providerName)
	if err != nil || provider == nil {
		return base.HTTPErrorf(http.StatusBadRequest, "Unable to identify provider for callback request")
	}

	client, err := provider.GetClient(h.ctx(), h.getOIDCCallbackURL)
	if err != nil {
		return fmt.Errorf("OIDC initialization error: %w", err)
	}

	context := auth.GetOIDCClientContext(provider.InsecureSkipVerify)
	token, err := client.Config().TokenSource(context, &oauth2.Token{RefreshToken: refreshToken}).Token()
	if err != nil {
		base.InfofCtx(h.ctx(), base.KeyAuth, "Unsuccessful token refresh: %v", err)
		return base.HTTPErrorf(http.StatusInternalServerError, "Unable to refresh token.")
	}

	rawIDToken, ok := token.Extra(keyIDToken).(string)
	if !ok {
		return base.HTTPErrorf(http.StatusInternalServerError, "No id_token field in oauth2 token.")
	}
	base.InfofCtx(h.ctx(), base.KeyAuth, "Obtained token from Authorization Server: %v", rawIDToken)

	username, sessionID, err := h.createSessionForTrustedIdToken(rawIDToken, provider)
	if err != nil {
		return err
	}

	refreshResponse := &OIDCTokenResponse{
		IDToken:   rawIDToken,
		SessionID: sessionID,
		Username:  username,
	}

	if provider.IncludeAccessToken {
		refreshResponse.AccessToken = token.AccessToken
		refreshResponse.Expires = int(token.Expiry.Sub(time.Now()).Seconds())
		refreshResponse.TokenType = token.TokenType
	}

	h.writeJSON(refreshResponse)
	return nil
}

func (h *handler) createSessionForTrustedIdToken(rawIDToken string, provider *auth.OIDCProvider) (username string, sessionID string, err error) {
	user, updates, tokenExpiryTime, err := h.db.Authenticator(h.ctx()).AuthenticateTrustedJWT(rawIDToken, provider, h.getOIDCCallbackURL)