8000 Fix openid scope loss on token refresh by himanshu7745 · Pull Request #52622 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

Fix openid scope loss on token refresh #52622

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mposolda merged 8 commits into from
Sep 16, 2026
Merged

Fix openid scope loss on token refresh #52622

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
7905af7
Fix openid scope loss on token refresh
himanshu7745 Sep 10, 2026
96bc755
Merge branch 'main' into fix/52574-openid-refresh-scope
himanshu7745 Sep 10, 2026
7e68365
Merge branch 'main' into fix/52574-openid-refresh-scope
himanshu7745 Sep 11, 2026
3ba30a8
fix: ensure OIDC scope is correctly preserved during token refresh in…
himanshu7745 Sep 11, 2026
02a42b2
fix: retain OIDC scope during refresh token process and add correspon…
himanshu7745 Sep 11, 2026
7777889
test: enhance RefreshTokenTest to validate ID token properties after …
himanshu7745 Sep 11, 2026
cae71f1
Fix refresh token scope test expectation
himanshu7745 Sep 14, 2026
5ed0ef1
Merge branch 'main' into fix/52574-openid-refresh-scope
himanshu7745 Sep 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions services/src/main/java/org/keycloak/protocol/oidc/refresh/AbstractRefreshTokenProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@
import org.keycloak.representations.AccessToken;
import org.keycloak.representations.AuthorizationDetailsJSONRepresentation;
import org.keycloak.representations.RefreshToken;
import org.keycloak.services.util.DefaultClientSessionContext;
import org.keycloak.util.TokenUtil;

import org.jboss.logging.Logger;
Expand Down Expand Up @@ -121,6 +122,7 @@ public TokenManager.AccessTokenResponseBuilder refreshAccessToken(RefreshTokenCo
clientSessionCtx.setAttribute(OIDCLoginProtocol.NONCE_PARAM, oldRefreshToken.getNonce());
}
clientSessionCtx.setAttribute(Constants.GRANT_TYPE, OAuth2Constants.REFRESH_TOKEN);
clientSessionCtx.setAttribute(DefaultClientSessionContext.ORIGINAL_REFRESH_TOKEN_SCOPE, oldRefreshToken.getScope());

// recreate token.
AccessToken newToken = tokenManager.createClientAccessToken(session, realm, authorizedClient, user, userSession, clientSessionCtx, userSession.isOffline());
Expand Down Expand Up @@ -173,8 +175,7 @@ public TokenManager.AccessTokenResponseBuilder refreshAccessToken(RefreshTokenCo
responseBuilder.getRefreshToken().setAuthorization(newToken.getAuthorization());
}

String scopeParam = clientSession.getNote(OAuth2Constants.SCOPE);
if (TokenUtil.isOIDCRequest(scopeParam)) {
if (TokenUtil.isOIDCRequest(oldRefreshToken.getScope())) {
responseBuilder.generateIDToken().generateAccessTokenHash();
}

Expand Down
17 changes: 13 additions & 4 deletions services/src/main/java/org/keycloak/services/util/DefaultClientSessionContext.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,7 @@
public class DefaultClientSessionContext implements ClientSessionContext {

private static final Logger logger = Logger.getLogger(DefaultClientSessionContext.class);
public static final String ORIGINAL_REFRESH_TOKEN_SCOPE = "original_refresh_token_scope";

private final AuthenticatedClientSessionModel clientSession;
private final Set<ClientScopeModel> requestedScopes;
Expand Down Expand Up @@ -193,8 +194,7 @@ public String getScopeString(boolean ignoreIncludeInTokenScope) {
if (Profile.isFeatureEnabled(Profile.Feature.PARAMETERIZED_SCOPES)) {
String scopeParam = buildScopesStringFromAuthorizationRequest(ignoreIncludeInTokenScope);
logger.tracef("Generated scope param with Parameterized Scopes enabled: %1s", scopeParam);
String scopeSent = requestedScopeString;
if (TokenUtil.isOIDCRequest(scopeSent)) {
if (isOIDCRequest()) {
scopeParam = TokenUtil.attachOIDCScope(scopeParam);
}
return scopeParam;
Expand All @@ -207,14 +207,23 @@ public String getScopeString(boolean ignoreIncludeInTokenScope) {
.collect(Collectors.joining(" "));

// See if "openid" scope is requested
String scopeSent = requestedScopeString;
if (TokenUtil.isOIDCRequest(scopeSent)) {
if (isOIDCRequest()) {
scopeParam = TokenUtil.attachOIDCScope(scopeParam);
}

return scopeParam;
}

private boolean isOIDCRequest() {
if (TokenUtil.isOIDCRequest(requestedScopeString)) {
return true;
}
if (OAuth2Constants.REFRESH_TOKEN.equals(getAttribute(Constants.GRANT_TYPE, String.class))) {
return TokenUtil.isOIDCRequest(getAttribute(ORIGINAL_REFRESH_TOKEN_SCOPE, String.class));
}
return false;
}

/**
* Get all the scopes from the {@link AuthorizationRequestContext} by filtering entries by Source and by whether
* they should be included in tokens or not.
Expand Down
89 changes: 89 additions & 0 deletions tests/base/src/test/java/org/keycloak/tests/oauth/RefreshTokenTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@
import org.keycloak.jose.jws.JWSHeader;
import org.keycloak.jose.jws.JWSInput;
import org.keycloak.jose.jws.JWSInputException;
import org.keycloak.jose.jws.crypto.HashUtils;
import org.keycloak.models.AccountRoles;
import org.keycloak.models.Constants;
import org.keycloak.models.UserSessionProvider;
Expand Down Expand Up @@ -89,6 +90,8 @@
import org.keycloak.testsuite.util.oauth.AbstractHttpPostRequest;
import org.keycloak.testsuite.util.oauth.AbstractOAuthClient;
import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
import org.keycloak.testsuite.util.oauth.UserInfoResponse;
import org.keycloak.util.DPoPGenerator;

import org.apache.http.client.methods.CloseableHttpResponse;
Expand Down Expand Up @@ -753,6 +756,92 @@ public void refreshTokenReuseTokenWithoutRefreshTokensRevokedWithLessScopes() {
}
}

@Test
public void refreshTokenRetainsOpenidScopeWhenOmittedInRefreshRequest() {
try {
oauth.scope("openid profile");
oauth.doLogin("test-user@localhost", "password");

String code = oauth.parseLoginResponse().getCode();

AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
assertEquals(200, tokenResponse.getStatusCode());
assertScopes("openid email profile", tokenResponse.getScope());

RefreshToken initialRefreshToken = oauth.parseRefreshToken(tokenResponse.getRefreshToken());
assertNotNull(initialRefreshToken);
assertScopes("openid basic email roles service_account web-origins acr profile", initialRefreshToken.getScope());

timeOffSet.set(2);

oauth.scope("profile");
AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
assertEquals(200, refreshResponse.getStatusCode());

assertScopes("openid email profile", refreshResponse.getScope());

UserInfoResponse userInfoResponse = oauth.doUserInfoRequest(refreshResponse.getAccessToken());
assertEquals(200, userInfoResponse.getStatusCode());

RefreshToken refreshedRefreshToken = oauth.parseRefreshToken(refreshResponse.getRefreshToken());
assertNotNull(refreshedRefreshToken);
assertScopes("openid basic email roles service_account web-origins acr profile", refreshedRefreshToken.getScope());
} finally {
oauth.scope(null);
}
}

@Test
public void refreshTokenRetainsOpenidScopeAfterClientSessionScopeNoteOverwritten() {
try {
AuthorizationEndpointResponse initialAuthResponse = oauth.loginForm()
.scope("openid profile")
.doLogin("test-user@localhost", "password");
assertNotNull(initialAuthResponse.getCode());

AccessTokenResponse initialTokenResponse = oauth.doAccessTokenRequest(initialAuthResponse.getCode());
assertEquals(200, initialTokenResponse.getStatusCode());
assertScopes("openid email profile", initialTokenResponse.getScope());

RefreshToken initialRefreshToken = oauth.parseRefreshToken(initialTokenResponse.getRefreshToken());
assertNotNull(initialRefreshToken);
assertScopes("openid basic email roles service_account web-origins acr profile", initialRefreshToken.getScope());

AuthorizationEndpointResponse laterAuthResponse = oauth.loginForm()
.scope("profile")
.doLoginWithCookie();
assertNotNull(laterAuthResponse.getCode());

AccessTokenResponse laterTokenResponse = oauth.doAccessTokenRequest(laterAuthResponse.getCode());
assertEquals(200, laterTokenResponse.getStatusCode());
assertScopes("email profile", laterTokenResponse.getScope());

timeOffSet.set(2);

oauth.scope("profile");
AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(initialTokenResponse.getRefreshToken());
assertEquals(200, refreshResponse.getStatusCode());
assertScopes("openid email profile", refreshResponse.getScope());

assertNotNull(refreshResponse.getIdToken());
IDToken refreshedIdToken = oauth.verifyToken(refreshResponse.getIdToken(), IDToken.class);
assertEquals(user.getId(), refreshedIdToken.getSubject());
assertNull(refreshedIdToken.getNonce());
assertNotNull(refreshedIdToken.getAccessTokenHash());
assertEquals(HashUtils.accessTokenHash(Algorithm.RS256, refreshResponse.getAccessToken()), refreshedIdToken.getAccessTokenHash());
assertNotEquals(HashUtils.accessTokenHash(Algorithm.RS256, initialTokenResponse.getAccessToken()), refreshedIdToken.getAccessTokenHash());

UserInfoResponse userInfoResponse = oauth.doUserInfoRequest(refreshResponse.getAccessToken());
assertEquals(200, userInfoResponse.getStatusCode());

RefreshToken refreshedRefreshToken = oauth.parseRefreshToken(refreshResponse.getRefreshToken());
assertNotNull(refreshedRefreshToken);
assertScopes("openid basic email roles service_account web-origins acr profile", refreshedRefreshToken.getScope());
} finally {
oauth.scope(null);
}
}

@Test
public void refreshTokenReuseTokenScopeParameterNotInRefreshToken() {
try {
Expand Down
Loading
0