search

Open-EO / openeo-aggregator

openEO driver that combines multiple other drivers
https://open-eo.github.io/openeo-aggregator/
Apache License 2.0
1 stars 1 forks source link

OIDC auth issues with EGI keycloak migration #68

Closed soxofaan closed 2 years ago

soxofaan commented 2 years ago

Since #51 (migration to EGI Keycloak instance), a couple of strange auth issues are popping up

soxofaan commented 2 years ago

on openeocloud-dev.vito.be we often had

OpenEoApiError: [403] TokenInvalid: Authorization token has expired or is invalid. Please authenticate again. (ref: r-cdf7e694eb4a4e9baa799804c2f73e22)

But I think that was due to a race condition where the keycloak-aware aggregator was deployed before the keycloak aware VITO backend. I now triggered a redeploy and the above issue seems to be resolved

soxofaan commented 2 years ago

what is still an issue (or at least a difference wtth the legacy EGI instance), is these warnings:

OIDC token response did not contain refresh token.

my first guess is that the refresh token grant does not include a (new) refresh token in its response from the keycloak based instance (while it is included with the legacy EGI instance)

soxofaan commented 2 years ago

OIDC token response did not contain refresh token.

see further discussion at https://github.com/openEOPlatform/architecture-docs/issues/261#issuecomment-1243881117

soxofaan commented 2 years ago

OIDC token response did not contain refresh token.

is addressed by https://github.com/Open-EO/openeo-python-client/issues/326

soxofaan commented 2 years ago

I think this can be closed now