Repository navigation
offline_access scope return always refresh_token - #10351
cgeorgilakis wants to merge 1 commit into
Conversation
99ec788 to
d28b88b
Compare
a18787d to
3b33f6b
Compare
|
@rmartinc This PR is related with your comment in my PR. |
There was a problem hiding this comment.
Offline-token is special type of refresh token. Hence if the switch Use Refresh Token is disabled, then any kind of refresh tokens should not be allowed. This means both "regular" refresh tokens as well as offline tokens.
The client switch Use refresh tokens currently maps to the OIDC client registration parameter value refresh_token being present in the property grant_types (See DescriptionConverter class for some additional context). It would be strange to allow offline tokens, but at the same time, not returning refresh_token in the grant_types .
What exactly is the actual use-case? Is it that for client foo, you want to allow offline tokens, but you do not want "regular" refresh tokens? If yes, it can be good to either:
- introduce dedicated switch on the client (EG.
Allow refresh request only for offline) - introduce client-policy executor implementation to the client policies, which will allow some configuration for some flexibility (EG. executor will have configuration switches like
Allow regular refresh tokensandallow offline refresh tokens. This may allow that former is disabled and latter is enabled to support the use-case like "Allow refresh tokens just if they are offline tokens")
|
@cgeorgilakis Closing (Please see my last comment for the details). Feel free to open new PR if this is still relevant for you. Please see my last comment for additional details. |
Closes #10346