OIDC lazy refresh #17

New issue

Closed

opened 2026-09-14 17:04:58 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-09-14 17:04:58 +00:00

Owner

Parent

#11 — Spec: The flow-serving bridge (gRPC ext_authz Check + OIDC/Exchange flows + callback/logout listener)

What to build

The OIDC refresh flow (keep-alive): a user who signed in 15 minutes ago is not bounced to Kanidm — the Bridge transparently renews the short-lived id_token via the refresh_token, so the Session outlives Kanidm's 15-minute id_token.

Acceptance criteria

When id_token.exp − now < margin (≈60s), the Check renews the Session via the refresh_token grant using the client secret (asserted on the token-endpoint double's received form).
Re-issues the Session cookie via OkHttpResponse.response_headers_to_add (Set-Cookie), then validates/injects the new id_token.
A failed refresh invalidates the Session and 302s to the authorization endpoint (fail-closed).
Verified with a hand-crafted Session cookie holding a near-expiry id_token + a refresh_token.

Blocked by

#14 — OIDC steady-state Check

## Parent #11 — Spec: The flow-serving bridge (gRPC ext_authz Check + OIDC/Exchange flows + callback/logout listener) ## What to build The OIDC refresh flow (keep-alive): a user who signed in 15 minutes ago is not bounced to Kanidm — the Bridge transparently renews the short-lived `id_token` via the `refresh_token`, so the Session outlives Kanidm's 15-minute `id_token`. ## Acceptance criteria - [ ] When `id_token.exp − now < margin` (≈60s), the `Check` renews the Session via the `refresh_token` grant using the client secret (asserted on the token-endpoint double's received form). - [ ] Re-issues the Session cookie via `OkHttpResponse.response_headers_to_add` (`Set-Cookie`), then validates/injects the new `id_token`. - [ ] A failed refresh invalidates the Session and 302s to the authorization endpoint (fail-closed). - [ ] Verified with a hand-crafted Session cookie holding a near-expiry `id_token` + a `refresh_token`. ## Blocked by - #14 — OIDC steady-state Check

ginjiruu added this to the Flow-serving bridge (spec #11) milestone

2026-09-14 17:05:34 +00:00

ginjiruu added the

ready-for-agent

label

2026-09-14 17:08:13 +00:00

ginjiruu referenced this issue from a pull request that will close it,

2026-09-15 04:55:18 +00:00

OIDC lazy refresh (margin-gated refresh_token grant, cookie re-issue, fail-closed 302) #26

ginjiruu closed this issue

2026-09-15 17:23:05 +00:00

ginjiruu referenced this issue