apache / apache/apisix

bug: openid-connect plugin does not refresh access token when end server responds with 401

Open
#13,750 0 comments 0 reactions 0 assignees View on GitHub
bug plugin
Dominant language
Lua
Stars
17.1k
Forks
2.9k
Avg merge
3d 16h
Merged PRs (30d)
63

Description

### Current Behavior

I understand that the openid-connect plugin does not have support for back-channel logout... our service behind the plugin does support this and knows when a user logs out or token is revoked.

Right now we have requests going through a route configured with the plugin. Authentication happens normally, the user is redirected to the IDP and then the session is created with a cookie and everything works.

The problem is after the user logs out by other means. Our backend server gets notified of the logout and considers the users access token invalid.

When a request happens again through the route with the plugin, we return a 401 from the backend server and the 401 is returned through the route instead of the openid-connect plugin trying to acquire a new token.

This is noticeable when the user logs back in, the route is broken for them until the access token it had eventually expires.

Or when the user logs in as someone else, the same thing happens.

### Expected Behavior

We expect the openid-connect plugin to try to get a new access token if the token it has results in a 401 where it is being used.

### Error Logs

_No response_

### Steps to Reproduce

1. configure route with openid-connect plugin
2. log in user with credentials through route
3. invalidate the token through other means (re-log in, or log in as new user)
4. try to access through route again

### Environment

apisix version 3.17.0

Contributor guide

Open the contributing guide

Research direction

Start with the openid-connect plugin entry point and reproduce the listed flow: authenticate, invalidate the token, then send another request through the route. Trace how an upstream 401 is handled and verify that a replacement access token is acquired and the request succeeds for the current user.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua
Domain
api, authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.