element-hq / element-hq/synapse
Allow User Login Admin API to return refresh tokens
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
Imagine I have configured Synapse (legacy) SSO with [`nonrefreshable_access_token_lifetime: 24h`](https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#nonrefreshable_access_token_lifetime) in order to encourage admins and users to use refresh tokens.
I also have an admin tool that I have an account for, and would like to log into that account using the [User Login Admin API](https://element-hq.github.io/synapse/latest/admin_api/user_admin_api.html).
Currently, I can do so and receive an `access_token`. But this access token will expire in 24hrs! I'd love to be able to get back a refresh token that I can use to refresh the `access_token` before it expires every 24hrs.
### Proposal
Similar to the [User Registration Admin API](https://element-hq.github.io/synapse/latest/admin_api/register_api.html#shared-secret-registration), we add a `refresh_token` body parameter to the [User Login Admin API](https://element-hq.github.io/synapse/latest/admin_api/user_admin_api.html). This would then cause a refresh token to be returned in a `refresh_token` field in the response.
Admin tooling could then [refresh](https://spec.matrix.org/v1.13/client-server-api/#post_matrixclientv3refresh) the access token in order to get back a new access token with a fresh 24hr lifetime.
Contributor guide
Assessment
This issue has not been assessed yet.