refresh request discards id_token

[muir]

Is your feature request related to a problem? Please describe.

Token refresh MAY return an id_token. See oipenid.net

rp.RefreshAccessToken discards the returned id_token (assuming it was returned).

Debugging shows an id_token returned in the response, but the returned model, oath2.Token doesn't include IDToken.

Why do I care? Keycloak wants id_token_hint filled out when doing a logout.

Describe the solution you'd like

Introduce rp.RefreshTokens and deprecate rp.RefreshAccessToken. The new function would return

type Tokens struct {
   oauth2.Token
   IDToken string
}

Describe alternatives you've considered

Consiering:

• return *oidc.Tokens[C] instead of the above simple composite.
  @muhlemmer : what do you think?

• build RefreshTokens() on top of oauth2.ReuseTokenSourceWithExpiry()
  That has to be fed an *oauth2.Token so the current API to RefreshAccessToken probably has to change unless we can build an *oauth2.Token from what we have there. Maybe? I may give this a try because it it works, the resulting *oauth2.Token could include an id_token that can be extracted with Extra().

  This might look like:

func RefreshTokens(ctx context.Context, rp RelyingParty, currentToken *oauth2.Token, earlyExpire time.Duration) (*oauth2.Token, error) {
        tokenSource := rp.OAuthConfig().TokenSource(ctx, currentToken)
        if earlyExpire != 0 {
                tokenSource = oauth2.ReuseTokenSourceWithExpiry(currentToken, tokenSource, earlyExpire)
        }
        return tokenSource.Token()
}

• Keep the current API and embed the id_token using token.WithExtra().

Rejected:

• a separate function to refresh the id_token
• not deprecating RefreshAccessToken
  let's not keep supporting a broken interface.
• changing RefreshAccessToken only in v3

Additional context

The server side, in pkg/op, returns an id_token for token refresh but pkg/client/rp ignores it.

[muhlemmer]

Merged the feat into main. Decided to keep the issue open, so we can make the breaking change to v3 /next.

Introduce rp.RefreshTokens and deprecate rp.RefreshAccessToken. The new function would return

type Tokens struct {
  oauth2.Token
  IDToken string
}

This sounds like a good and simple solution.

return *oidc.Tokens[C] instead of the above simple composite.
@muhlemmer : what do you think?

Is also an option, however the IDTokenClaims C field are the decoded, verified and unmarshalled claims. This means that rp.RefreshAccessToken() needs to get additional functionality that takes care of that, like we do in rp.CodeExchange().

Both option sound good to me, but depends how much work we want to put into this :).

[muir]

@muhlemmer do you want to introduce rp.RefreshTokens now? That's not a breaking change.

[github-actions]

🎉 This issue has been resolved in version 3.0.0-next.9 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[github-actions]

🎉 This issue has been resolved in version 3.0.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀