providers/oauth2: fix refresh_token grant returning incorrect id_token

[BeryJu]

Details

#4191

---

Checklist

• Local tests pass (ak test authentik/)
• The code has been formatted (make lint-fix)

If an API change has been made

• The API schema has been updated (make gen-build)

If changes to the frontend have been made

• The code has been formatted (make web)

If applicable

• The documentation has been updated
• The documentation has been formatted (make website)

[netlify]

✅ Deploy Preview for authentik-docs canceled.

Name	Link
🔨 Latest commit	bb7599f
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-docs/deploys/661da24ca713f70008f32f60

[netlify]

✅ Deploy Preview for authentik-storybook canceled.

Name	Link
🔨 Latest commit	bb7599f
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-storybook/deploys/661da24c44afd700089a3962

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 92.37%. Comparing base (33fa159) to head (bb7599f).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9275      +/-   ##
==========================================
- Coverage   92.38%   92.37%   -0.01%     
==========================================
  Files         665      665              
  Lines       32609    32609              
==========================================
- Hits        30125    30124       -1     
- Misses       2484     2485       +1     

Flag	Coverage Δ
e2e	50.67% <ø> (-0.02%)	⬇️
integration	26.01% <ø> (ø)
unit	89.65% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[github-actions]

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-ghcr.io/goauthentik/dev-server:gh-bb7599f3ee5106aa3787ea204efd995a2dac997f
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

For arm64, use these values:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-ghcr.io/goauthentik/dev-server:gh-bb7599f3ee5106aa3787ea204efd995a2dac997f-arm64
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
image:
    repository: ghcr.io/goauthentik/dev-server
    tag: gh-ghcr.io/goauthentik/dev-server:gh-bb7599f3ee5106aa3787ea204efd995a2dac997f

For arm64, use these values:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
image:
    repository: ghcr.io/goauthentik/dev-server
    tag: gh-ghcr.io/goauthentik/dev-server:gh-bb7599f3ee5106aa3787ea204efd995a2dac997f-arm64

Afterwards, run the upgrade commands from the latest release notes.

[lsjostro]

Can we add proper integration tests for this?

[BeryJu]

@lsjostro do you have any suggestion on a client application that could be used for this? The OpenID compliance test didn't complain about this

I'll still merge this as-is for the time being so it can be included in 2024.4

[lsjostro]

I'm more searching for why this hasn't been noticed since the last fix 2 years ago? How can we prevent it will not happen in the future? issuing tokens valid for 30 days without letting users know is a big regression if you ask me. Writing e2e/integration tests and validating configuration vs token expire times etc would help? I dont think the compliance test would have caught this right? But yeah merge it and get it released asap is of course most important right now 👍🏻 and thanks for the quick fix!

[BeryJu]

@lsjostro I'm assuming that most applications don't use the id_token part of a refresh_token grant as even the OIDC spec says this is optional, and hence it hasn't been noticed

[lsjostro]

that's not true, first app that pops up is the k8s api server?

[BeryJu]

sorry I meant from the apps I've used with the OIDC provider, I've not set up my K8s clusters to use the authentik OIDC provider yet