Contrib.social

refresh tokens do not seen to work

Open on Drupal.org →
Created on 17 February 2025, 3 months ago
Updated 27 February 2025, 2 months ago

Problem/Motivation

Users are logged out too early

Steps to reproduce

Login -> Sessions expires too early

Get-AdfsProperties | fl SsoLifetime
SsoLifetime : 480

Proposed resolution

 protected function ensureValidAccessToken(RequestEvent $event) {

   // Check if the access token has expired.
    if (!$this->isTokenExpired($tokens->getAccessToken())) {
      return;    /* in case we have  a valid Access Token -> return */
    }

  // Logout if there's no valid refresh token.
    if ($this->isTokenExpired($tokens->getRefreshToken())) {
      $this->logout($event);
      return;    
    }


  */ How do we get here? 

   As long as we have a valid access token we will never get a refresh token
  
  */

 // Update the tokens.      

/* $tokens->getRefreshToken() is null? -> Fail? */

 $tokens = $plugin->getJsonWebTokensforRefresh($tokens->getRefreshToken());

https://github.com/MicrosoftDocs/windowsserverdocs/blob/main/WindowsServ...

Simple logon, no KMSI, device not registered: AD FS applies SsoLifetime and DeviceUsageWindowInDays. The first refresh token has lifetime=DeviceUsageWindowInDays or SsoLifetime, based on which field is lower but no further refresh tokens are issued.

🐛 Bug report
Status

Active

Version

2.0

Component

Code

Created by

christoph_vw

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024