Preflight checklist <

feature request: hooks for managing oidc/oauth states about kratos HOT 3 OPEN

aran commented on July 17, 2024

feature request: hooks for managing oidc/oauth states

from kratos.

Comments (3)

jonas-jonas commented on July 17, 2024

For case of a bad refresh token, I tried a PUT to overwrite the "initial_refresh_token" with an empty value to indicate that a reconnect is needed. But Kratos seems to reject updating that field.

AFAIK, Kratos only stores the initial access+refresh tokens and doesn't update them at all. They are just available to the implementor in case they want to request more data from the OIDC provider, just after completing the registration flow.

I guess we could store the new access + refresh tokens after logging again - not sure why this isn't the case right now.

When would you check for the scope validity? E.g. what would the API for this look like?

from kratos.

aran commented on July 17, 2024

I guess we could store the new access + refresh tokens after logging again - not sure why this isn't the case right now.

One reason might be that the request issued to authorization server must be different - prompt=none (or omitted) vs. prompt=consent. Actually that raises that another way to look at this would be that functionally, it would be useful to have Kratos store info to better informwhether to set prompt=consent when Kratos talks to OAuth authorization server.

When would you check for the scope validity?

One way that is congruent with how other things in Kratos work would be to have a named hook (like the session hook), which if specified in configuration, would check the tokens after receiving them in a provider-dependent manner (e.g. for Google, https://www.googleapis.com/oauth2/v1/tokeninfo?access_token=...)

E.g. what would the API for this look like?

Scope checking:

        oidc:
          hooks:
          - hook: "session"
          - hook: "scopes"

User storage, something like this (assuming scopes is omittable when unknown, and scopes, access_token and refresh_token can be GET/PUT over the HTTP admin API:

 {
     "id": "d50b35ad-6b22-4b0d-9f7e-2bb1ced8816e",
     "credentials": {
         "oidc": {
           "type": "oidc",
           "identifiers": [
             "google-web-1:123456789012345678901"
           ],
           "config": {
             "providers": [
               {
                 "initial_id_token": "w6MncQ1TfhzHpg",
                 "subject": "123456789012345678901",
                 "provider": "google-web-1",
                 "organization": "",
                 "initial_access_token": "+oUl+QpCe5Rpug",
                 "initial_refresh_token": "5L/84eMTDMXw4g",
+                "scopes": [
+                    "openid",
+                    "email",
+                    "profile",
+                    "offline_access",
+                    "https://www.googleapis.com/auth/userinfo.email"
+                ],
+                "scopes_changed_at": "2024-05-30T15:09:08.433369Z",
+                "access_token": "w/EhoZCq1ympjQ==",
+                "access_token_changed_at": "2024-05-30T15:09:08.433369Z",
+                "refresh_token": "QPoBK8rOB82TeA",
+                "refresh_token_changed_at": "2024-05-30T15:09:08.433369Z"
               }
             ]
           },
           "version": 0,
           "created_at": "2024-05-30T15:09:08.433369Z",
           "updated_at": "2024-05-30T15:09:08.433369Z"
         },
         "password": {
           "type": "password",
           "identifiers": [
             "+12025555555"
           ],
           "version": 0,
           "created_at": "2024-05-30T15:09:08.433365Z",
           "updated_at": "2024-05-30T15:09:08.433365Z"
         }
       },
     "schema_id": "default.0",
     "schema_url": "http://localhost:4433/schemas/ZGVmYXVsdC4w",
     "state": "active",
     "state_changed_at": "2024-05-30T15:05:52.766066Z",
     "traits": {
         "name": "Toby",
         "phone": "+12025555555"
     },
     "metadata_public": null,
     "metadata_admin": null,
     "created_at": "2024-05-30T15:05:52.766732Z",
     "updated_at": "2024-05-30T15:05:52.766732Z",
     "organization_id": null
 }

(Edited because I rediscovered upstream_parameters)

from kratos.

aran commented on July 17, 2024

After learning more about this stuff, there's also an argument to be made that these tokens "should" be encrypted. Anyone who wants that would also need initial_refresh_token and initial_access_token encrypted, though.

from kratos.

feature request: hooks for managing oidc/oauth states about kratos HOT 3 OPEN

Comments (3)

Related Issues (20)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent