Does OIDC Client token support automatic refresh before the token expires

[Umizhang0910]

Hi, everyone,

Does the token held by TokenRequestState support automatic refresh before expiration, instead of finding the token expires when the request comes, and then requesting IDP to obtain or refresh the token.

Is there any mechanism inside the Quarkus framework that supports automatic refresh of tokens?

Use scenarios

• My usage scenario is that I request another service on the current service. I configured OIDC Client and filter. In theory, when I call the client's method, the requested token will be attached;
• My token is valid for 60 minutes. When multiple requests come in, the token happens to expire, and the request will be blocked until the request IDP gets a new token;
• My requirement is whether the token mechanism of the quarkus framework supports automatic refreshing, when the token is about to expire, rather than when a request comes in

[quarkus-bot[bot]]

/cc @pedroigor (oidc), @sberyozkin (oidc)

[sberyozkin]

Hi @Umizhang0910

It is an interesting idea, but I'm not sure it is worth the extra complexity it would bring with it (managing a timer, syncing with the actual OidcClient requests) given that the token refresh occurs once every 60 mins or several days or even longer periods of time, with the most likely case being, that in a highly concurrent application only a few OIDC client requests might need to wait for a few milliseconds, and then all is flowing for another 60 mins, etc

[Umizhang0910]

Hi @sberyozkin , Thank you for your reply

From your reply, we can see that the quarkus framework is not currently supported. You think that because the token itself is provided by the IDP service, the token expiration time is set based on the customer's own; therefore, the token validity period may often be 60 minutes, one day, or longer, so the additional complex mechanism of introducing a timed task to automatically refresh the token is a bit more cost-effective.

In view of this, I will try to implement the mechanism of automatic refresh before the token expires. If you have any better suggestions, I'm looking forward to your reply.