Skip to content

id_token is processed and stored during refresh token flow when AuthConfig.oidc = false #1254

@buchatsky

Description

@buchatsky

Describe the bug
I use Authorization Code flow with refresh_token. Id provider also returns an id_token, but I don't need it, so I set AuthConfig.oidc = false and use oauthService.tryLogin() instead of oauthService.loadDiscoveryDocumentAndTryLogin().
id_token is not processed and stored during initial authorization_code flow, but surprisingly is processed and stored during all subsequent refresh_token flows (in case of loadDiscoveryDocumentAndTryLogin()) or the exception "Parameter jwks expected!" is thrown (in case of tryLogin()).
The cause is that this.oidc is checked in fetchTokenUsingGrant() and fetchAndProcessToken() functions

if (this.oidc && tokenResponse.id_token) {
  this.processIdToken(tokenResponse.id_token, tokenResponse.access_token).then((result) => {

but not in refreshToken()

if (tokenResponse.id_token) {
  return from(this.processIdToken(tokenResponse.id_token, tokenResponse.access_token, true)).pipe(tap((result) => 

Expected behavior
id_token to be NOT processed and stored during refresh token flow when AuthConfig.oidc = false

Desktop (please complete the following information):

  • OS: Windows 10
  • Browser: Google Chrome
  • Version: 13.0.1

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugFor tagging faulty or unexpected behavior.investigation-neededIndication that the maintainer or involved community members may need to investigate more.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions