OIDC Automatic Refresh Token

thomas.shannon · May 21, 2020, 5:27pm

Hello,

I am currently facing an issue with my Hue application. My team and I have implemented OIDC authentication into the application, but are a bit confused about how Hue handles the OIDC refresh token process.

We noticed the OIDC_RENEW_ID_TOKEN_EXPIRY_SECONDS parameter that sets the oidc token expiration as seen below.

github.com

cloudera/hue/blob/faebb36a7b1b3f56e1871189c45359f4d6ac4e02/desktop/core/ext-py/mozilla-django-oidc-1.0.0/mozilla_django_oidc/views.py#L53


    return next_url or import_from_settings('LOGIN_REDIRECT_URL', '/')


def login_failure(self):
    return HttpResponseRedirect(self.failure_url)


def login_success(self):
    auth.login(self.request, self.user)


    # Figure out when this id_token will expire. This is ignored unless you're
    # using the RenewIDToken middleware.
    expiration_interval = import_from_settings('OIDC_RENEW_ID_TOKEN_EXPIRY_SECONDS', 60 * 15)
    self.request.session['oidc_id_token_expiration'] = time.time() + expiration_interval


    return HttpResponseRedirect(self.success_url)


def get(self, request):
    """Callback handler for OIDC authorization code flow"""


    nonce = request.session.get('oidc_nonce')
    if nonce:
        # Make sure that nonce is not used twice

However, we noticed after this token expires, Hue goes into an internal error when trying to refresh the page. Does anyone have any general guidance on refreshing the token after the expiration? Or of a way that automatically logs the user out when the oidc token expires.

Thanks,
Tom

Romain · May 22, 2020, 6:50pm

OIDC was introduced 2 years ago: https://github.com/cloudera/hue/commit/d1801c9e0491666d0878a24d8d84a7e79b85bacf

Not sure about the refresh, what is the error trace? (it might need a code change to improve)