cloudfoundry / cloudfoundry/uaa
CF UAA Does Not Store or Use External IDP's Refresh Token
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.6k
- Forks
- 844
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 27
Description
Description:
When integrating with an external Identity Provider (IDP), CF UAA does not store the access token or refresh token issued by the external IDP. This leads to a problem when UAA’s own refresh token expires.
For example, if UAA's refresh token expires in 2 hours but the external IDP's refresh token is valid for 24 hours (or any longer duration depending on its configuration), UAA is unable to obtain a new access token from the external IDP after its own token expires. This is because UAA does not retain the external IDP's refresh token, which would still be valid.
Impact:
This limitation breaks long-lived sessions and forces users to reauthenticate even though the external IDP's refresh token is still valid.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or entry points. Start by locating the external identity-provider token handling and the UAA refresh-token flow, then determine how external access and refresh tokens should be retained and used after the UAA token expires; done means long-lived sessions can renew without reauthentication when the external refresh token remains valid.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100