envoyproxy / envoyproxy/envoy

[OAUTH2] Forward ID Token and Refresh Token

Open
#15,489 7 comments 6 reactions 1 assignee Claimed by @zhaohuabing View on GitHub
area/oauth enhancement help wanted
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 20h
Merged PRs (30d)
437

Description

*Title*: *Allow oauth2 forwarding of refresh/id token*

*Description*:
> We are trying to use the oauth2 filter to manage an auth2 /oidc flow, but the current implementation can only forward the access token through the filter chain/to downstream and not other tokens potentially returned from the id provider (i.e. refresh token, id token).

I believe this would require an extension of https://github.com/envoyproxy/envoy/blob/23a97fbb237b51f10c19c8c228f74faf7ec65370/source/extensions/filters/http/oauth2/oauth_client.cc#L32

The desired behavior i think would be options of embedding more than just access token in the cookie - perhaps via an additional config to optionally determine which response keys from the `/token` endpoint should be embedded in the cookie and forwarded using `forward_bearer_token: true`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.