simple-ui: improve the oidc id token refresh #2534
Conversation
|
@zeapo , |
|
@avgustinmm hey, it's done. I've been testing it for a while on our deployment. I'm off for the next two weeks, won't be able to test changes on my work environment. |
|
Please let me know if anything is missing :) |
hawkbit-simple-ui/src/main/java/org/eclipse/hawkbit/ui/simple/security/OAuth2TokenManager.java
Show resolved
Hide resolved
hawkbit-simple-ui/src/main/java/org/eclipse/hawkbit/ui/simple/SimpleUIApp.java
Outdated
Show resolved
Hide resolved
hawkbit-simple-ui/src/main/java/org/eclipse/hawkbit/ui/simple/SimpleUIApp.java
Outdated
Show resolved
Hide resolved
zeapo
force-pushed
the
feature/fix-oauth-hack
branch
from
66938d9 to
5c19021
Compare
|
|
|
||
| // This ensures that there is a client already, otherwise we won't be able to call the manager for authorization | ||
| OAuth2AuthorizedClient authorizedClient = clientService.loadAuthorizedClient(registrationId, authentication.getName()); | ||
| if (authorizedClient == null) return null; | ||
| if (authorizedClient == null) return currentToken; |
There was a problem hiding this comment.
If client isn't found why return a token ?
There was a problem hiding this comment.
Hehe, this is the tricky parts of how simple-ui rights are working. It hijacks the authentication process, hence the initial step where it fetches the rights to create the authorities, the authorizedClient does not exist.
That's why this OIDC process is much more complex than it should've been.
After the upgrade to Spring Boot 3.5.x, the authorized client manager will attempt a refresh of the oidc id token.
Sadly, I thought that it would be a simple clean replacement of the previous hackish code. However, it looks like vaadin does not like the SpringContextHolder.setContext() hacks (if you guys have a solution I'm all ears). Here's what happens when the token expires:
Unfortunately, i'm unable to make the SpringContextHolder clear and use the temporary context in this situation, regardless of changing the strategy, the interceptor is always using the previous context.
To remediate this, I went with a bandaid, I fetch the previous user and re-use its grants; this works! But it is not the ideal solution :)
Here's an example of how it works, it refreshes properly:
Screen.Recording.2025-07-07.at.15.40.36.mov