Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

connector: Connectors without a RefreshConnector should not error out #872

Merged
merged 1 commit into from
Mar 23, 2017
Merged

connector: Connectors without a RefreshConnector should not error out #872

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions connector/oidc/oidc.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,7 @@ func (c *Config) Open(logger logrus.FieldLogger) (conn connector.Connector, err

var (
_ connector.CallbackConnector = (*oidcConnector)(nil)
_ connector.RefreshConnector = (*oidcConnector)(nil)
)

type oidcConnector struct {
Expand Down Expand Up @@ -188,3 +189,8 @@ func (c *oidcConnector) HandleCallback(s connector.Scopes, r *http.Request) (ide
}
return identity, nil
}

// Refresh is implemented for backwards compatibility, even though it's a no-op.
func (c *oidcConnector) Refresh(ctx context.Context, s connector.Scopes, identity connector.Identity) (connector.Identity, error) {
return identity, nil
}
6 changes: 0 additions & 6 deletions connector/saml/saml.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,12 +241,6 @@ type provider struct {

func (p *provider) POSTData(s connector.Scopes, id string) (action, value string, err error) {

// NOTE(ericchiang): If we can't follow up with the identity provider, can we
// support refresh tokens?
if s.OfflineAccess {
return "", "", fmt.Errorf("SAML does not support offline access")
}

r := &authnRequest{
ProtocolBinding: bindingPOST,
ID: id,
Expand Down
14 changes: 14 additions & 0 deletions server/handlers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -646,6 +646,20 @@ func (s *Server) handleAuthCode(w http.ResponseWriter, r *http.Request, client s
}

reqRefresh := func() bool {
// Ensure the connector supports refresh tokens.
//
// Connectors like `samlExperimental` do not implement RefreshConnector.
conn, ok := s.connectors[authCode.ConnectorID]
if !ok {
s.logger.Errorf("connector ID not found: %q", authCode.ConnectorID)
s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
return false
}
_, ok = conn.Connector.(connector.RefreshConnector)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can short circuit this.

if !ok {
    return false
}

This avoids the loop in some cases.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

if !ok {
return false
}

for _, scope := range authCode.Scopes {
if scope == scopeOfflineAccess {
return true
Expand Down