element-hq / element-hq/synapse

Allow User Login Admin API to return refresh tokens

Open
#18,100 2 comments 0 reactions 0 assignees View on GitHub
A-Admin-API A-Legacy-Auth O-Occasional S-Minor T-Enhancement
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

Imagine I have configured Synapse (legacy) SSO with [`nonrefreshable_access_token_lifetime: 24h`](https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#nonrefreshable_access_token_lifetime) in order to encourage admins and users to use refresh tokens.

I also have an admin tool that I have an account for, and would like to log into that account using the [User Login Admin API](https://element-hq.github.io/synapse/latest/admin_api/user_admin_api.html).

Currently, I can do so and receive an `access_token`. But this access token will expire in 24hrs! I'd love to be able to get back a refresh token that I can use to refresh the `access_token` before it expires every 24hrs.

### Proposal

Similar to the [User Registration Admin API](https://element-hq.github.io/synapse/latest/admin_api/register_api.html#shared-secret-registration), we add a `refresh_token` body parameter to the [User Login Admin API](https://element-hq.github.io/synapse/latest/admin_api/user_admin_api.html). This would then cause a refresh token to be returned in a `refresh_token` field in the response.

Admin tooling could then [refresh](https://spec.matrix.org/v1.13/client-server-api/#post_matrixclientv3refresh) the access token in order to get back a new access token with a fresh 24hr lifetime.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.