Backup_Repos/vaultwarden
1
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2025-12-31 21:03:09 +01:00
Code Issues Projects Releases Wiki Activity

sso(authentik): always surface current provider refresh token from exchange

Browse source
This commit is contained in:
Alex Smith 2025-10-14 15:09:26 -06:00 committed by GitHub
parent 3f010a50af
commit e16a24233c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 13 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
src/sso_client.rs
View file

@ -240,11 +240,19 @@ impl Client {
Ok(token_response) => token_response,
};
Ok((
token_response.refresh_token().map(|token| token.secret().clone()),
token_response.access_token().secret().clone(),
token_response.expires_in(),
))
// Always surface a refresh token:
// - If the IdP (e.g., Authentik) returned a rotated one, use it.
// - Otherwise, keep using the one we just used for this request.
let access = token_response.access_token().secret().clone();
let expires_in = token_response.expires_in();
let new_refresh = token_response
.refresh_token()
.map(|t| t.secret().clone())
.unwrap_or_else(|| rt.secret().clone());
Ok((Some(new_refresh), access, expires_in))
}
}