oidc: handle refresh token

Fix #338
Signed-off-by: spacewander <[email protected]>

plugins/oidc/config.go

@@ -16,6 +16,7 @@ package oidc
 
 import (
 	"context"
+	"encoding/base64"
 	"net/http"
 	"time"
 
@@ -65,6 +66,8 @@ type config struct {
 	oauth2Config   *oauth2.Config
 	verifier       *oidc.IDTokenVerifier
 	cookieEncoding *securecookie.SecureCookie
+	refreshLeeway  time.Duration
+	cookieEntryID  string
 }
 
 func (conf *config) ctxWithClient(ctx context.Context) context.Context {
@@ -84,6 +87,13 @@ func (conf *config) Init(cb api.ConfigCallbackHandler) error {
 	}
 	conf.opTimeout = du
 
+	du = 10 * time.Second
+	leeway := conf.GetAccessTokenRefreshLeeway()
+	if leeway != nil {
+		du = leeway.AsDuration()
+	}
+	conf.refreshLeeway = du
+
 	ctx := conf.ctxWithClient(context.Background())
 	var provider *oidc.Provider
 	var err error
@@ -104,6 +114,9 @@ func (conf *config) Init(cb api.ConfigCallbackHandler) error {
 		return err
 	}
 
+	if !conf.DisableAccessTokenRefresh {
+		conf.Scopes = append(conf.Scopes, oidc.ScopeOfflineAccess)
+	}
 	conf.oauth2Config = &oauth2.Config{
 		ClientID:     conf.ClientId,
 		ClientSecret: conf.ClientSecret,
@@ -116,5 +129,6 @@ func (conf *config) Init(cb api.ConfigCallbackHandler) error {
 	}
 	conf.verifier = provider.Verifier(&oidc.Config{ClientID: conf.ClientId})
 	conf.cookieEncoding = securecookie.New([]byte(conf.ClientSecret), nil)
+	conf.cookieEntryID = base64.RawURLEncoding.EncodeToString([]byte(conf.ClientId))
 	return nil
 }

plugins/oidc/config.proto

@@ -42,4 +42,12 @@ message Config {
   google.protobuf.Duration timeout = 8 [(validate.rules).duration = {
     gt: {},
   }];
+
+  bool disable_access_token_refresh = 9;
+  // The duration to determines how earlier a token should be considered
+  // expired than its actual expiration time. It is used to avoid late
+  // expirations due to client-server time mismatches. Default to 10s.
+  google.protobuf.Duration access_token_refresh_leeway = 10 [(validate.rules).duration = {
+    gte: {},
+  }];
 }

plugins/oidc/config_test.go

@@ -25,7 +25,7 @@ import (
 func TestBadIssuer(t *testing.T) {
 	c := config{
 		Config: Config{
-			Issuer:  "http://github.com",
+			Issuer:  "http://1.1.1.1",
 			Timeout: &durationpb.Duration{Seconds: 1}, // quick fail
 		},
 	}
@@ -36,7 +36,7 @@ func TestBadIssuer(t *testing.T) {
 func TestDefaultValue(t *testing.T) {
 	c := config{
 		Config: Config{
-			Issuer:  "http://github.com",
+			Issuer:  "http://1.1.1.1",
 			Timeout: &durationpb.Duration{Seconds: 1}, // quick fail
 		},
 	}