search

ging / fiware-idm

OAuth 2.0-based authentication of users and devices, user profile management, Single Sign-On (SSO) and Identity Federation across multiple administration domains.
https://keyrock-fiware.github.io
MIT License
37 stars 81 forks source link

How to refresh PEP Access Tokens in an immutable (Kubernetes) Deployment #223

Open pinkerltm opened 3 years ago

pinkerltm commented 3 years ago

I have IdM and multiple PEPs (deployed as sidecars to the actual API Containers) deployed in a Kubernetes environment. Access Tokens are checked out from IdM API at deployment time and passed via Environment-from-secret.

After a couple of days (180?) these Access tokens expire and the only possibility to refresh them is to delete and redeploy the Pods containing the PEPs (which is actually the same as redeploying Orion, QuantumLeap, etc..).

I am wondering if there is a better solution to this (Access Tokens with longer or no expiry time, runtime configuration of access tokens, etc..). This issue is also described in the PEP Proxy Repo (https://github.com/ging/fiware-pep-proxy/issues/128)

Siedlerchr commented 3 years ago

You can create a Permanent token in keyrock, there is also a special type for pep proxies. they are permament as well https://fiware-idm.readthedocs.io/en/latest/user_and_programmers_guide/application_guide/index.html#register-pep-proxy-and-iot-agents https://fiware-idm.readthedocs.io/en/latest/oauth/oauth_documentation/index.html#select-token-type