search

singingwolfboy / flask-dance

Doing the OAuth dance with style using Flask, requests, and oauthlib.
https://pypi.python.org/pypi/Flask-Dance/
MIT License
997 stars 156 forks source link

Update `contrib/azure.py` to enable automatic token refreshes #420

Closed mgd722 closed 4 months ago

mgd722 commented 1 year ago

Similarly to the Google behavior (outlined in #143 and #161), Azure will not send a refresh token unless you include the offline_access scope. I modeled my changes after contrib/google.py to stay consistent, and this update only sets the auto_refresh_url if you pass offline=True to the blueprint.

Closes #232 and #286 with a built-in solution instead of a login redirect.

Important note:

For some reason, oauthlib raises a full-blown exception for a scope mismatch instead of just a warning. Azure removes the offline_access scope, so using automatic refreshes you will always get an error like this:

Warning: Scope has changed from "openid offline_access User.Read profile email" to "User.Read openid email profile".

The kludgy workaround is to suppress the warning by setting the following environment variable:

OAUTHLIB_RELAX_TOKEN_SCOPE=1
daenney commented 1 year ago

Hiya! Thanks for the PR, I think the change looks good. Two small follow-up things to do before we merge this:

mgd722 commented 1 year ago

Sounds good, those are things I can do, but as a heads up: due to work deadlines and PTO it will likely take until mid/late July.

emer-bestseller commented 6 months ago

Are there any updates on this PR? I am facing the same issue, and this seems like the "proper" fix

singingwolfboy commented 6 months ago

Are there any updates on this PR? I am facing the same issue, and this seems like the "proper" fix

It looks like the author of this PR has not had time to do the necessary work. If this is important to you, you could open a new PR that includes these changes, and the extra work required to get them merged.

mgd722 commented 4 months ago

Looks like https://github.com/singingwolfboy/flask-dance/pull/428/ saw this through better than me, and is merged into prod. Closing.