spring-projects / spring-projects/spring-security

Consider adding support for requesting refresh_token with offline_access scope

Open
#18,298 5 comments 8 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

in: oauth2 type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Expected Behavior
I want to add support for the offline_access scope as described in the openid-connect rfc. When the offline_access scope is requested, then a refresh token is issued.

Current Behavior
Currently the spring-authorization-server project issues a refresh token when a RegisteredClient contains AuthorizationGrantType.REFRESH_TOKEN. I would like to change this behavior so that the the client must request the offline_access scope in order for a refresh token to be issued.

Context
What is the best way to add support for this? Initially, I tried copying all of the code from OAuth2AuthorizationCodeAuthenticationProvider into my own custom implementation and edited the conditional statement that determines whether or not refresh token should be issued. However, I would like to avoid copying and overriding this for maintainability reasons. Is there a way to customize this for our implementation? Is this a feature that we could add to directly to the spring-authorization-server project?

Related spring-projects/spring-authorization-server#501 spring-projects/spring-authorization-server#1430

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Read oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationProvider.java, especially the conditional at line 216. Review related issues #501 and #1430 for prior context. Done means supporting the offline_access scope so refresh-token issuance follows the requested scope without requiring copied provider code.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
authentication, authorization, backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.