search

linagora / openpaas-auth-client

OpenPaaS Authentication Client
Other
1 stars 6 forks source link

Support silent renew #5

Closed MichaelBailly closed 3 years ago

chamerling commented 3 years ago

Silent renew is supported in oidc-client with a page each SPA must provide and used in an invisible iframe (plus some configuration).

chamerling commented 3 years ago

Linked PRs:

Note that you will have to apply the same changes as for https://github.com/OpenPaaS-Suite/esn-frontend-account/pull/80 in all the SPAs to support silent renew.

This has been tested on keycloak, and there are no reason to not have this working on other OIDC providers just because this is only frontend code checking that the session is still OK using token stored on the browser.

To test it, I updated the access_token lifespan to 2 minutes (setting is to 1 minutes cause infinite loop on the client)

Capture d’écran 2020-11-23 à 11 49 22

Some browser logs:

Capture d’écran 2020-11-23 à 11 58 32

tanandy commented 3 years ago

Hi tks @chamerling can you confirm we can remove lemonldap RP iframe hack ? since we can use the RP iframe provided by oidc client or we need it also

https://ci.linagora.com/linagora/lgs/openpaas/openpaas-platform-docker-dev/commit/ddd460b830407d0f5f036f8c616ceb77e952986e

plz note that lemonldap is using opaque token and keycloak jwt token for access token fyi

tanandy commented 3 years ago

cc @tuanlc

chamerling commented 3 years ago

I am not aware of any Lemon hack, nor about how Lemon works. The oidc-client iframe should be enough. If not, Lemon probably has some OIDC implementation issues...