SAML2 silent refresh (OAuth2 with &prompt=none) fails

Haufe-Lexware / wicked.haufe.io

An API Management system based on Mashape Kong

http://wicked.haufe.io

Other

121 stars 37 forks source link

SAML2 silent refresh (OAuth2 with &prompt=none) fails #259

Closed DonMartin76 closed 4 years ago

DonMartin76 commented 4 years ago

SAML2 supports a silent refresh in the case the session with the wicked authorization server has run out. This is only supported if the auth server runs via https, but it also does not work in that case in rc.11 or below.

This is due to a bug which checks the wrong part of the auth server URL for "https" (the path, not the entire URL).

DonMartin76 commented 4 years ago

This has been fixed for rc.12.