canonical / canonical/authd

Use default interval for device access token polling in the generic OIDC broker

Open
#1,163 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
308
Forks
41
Avg merge
2d 4h
Merged PRs (30d)
58

Description

We reduced the device access token polling interval in https://github.com/ubuntu/authd-oidc-brokers/pull/673 from 5 to 1 second to improve UX. That works fine with Entra ID and Google, but it turns out other IdPs don't like it: A [hydra](https://github.com/ory/hydra) instance set up by the identity team keeps replying with "429 Too Many Requests" even though the golang.org/x/oauth2 package which we're using [handles that error by increasing the interval by 5 seconds](https://cs.opensource.google/go/x/oauth2/+/refs/tags/v0.34.0:deviceauth.go;drc=fd15e0fe894866ebff17ca3503d3706a967b061a;l=217).

Let's follow the spec and use the default interval in the generic OIDC broker. The authd-msentraid and authd-google brokers should be able to override that, which requires adding a `AccessTokenPollingInterval` method to the provider interface - I'll create a separate issue for that.

Contributor guide

Open the contributing guide

Research direction

Start by tracing device access token polling in the generic OIDC broker and inspect how it uses golang.org/x/oauth2's default interval and provider interface. The change is done when the generic broker follows the default polling behavior described in the issue without imposing the reduced one-second interval; the broker's tests should cover the resulting behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.