fix: re-authenticate when requested scopes exceed the cached token - #68
Open
mjdavidson wants to merge 1 commit into
Open
fix: re-authenticate when requested scopes exceed the cached token#68mjdavidson wants to merge 1 commit into
mjdavidson wants to merge 1 commit into
Conversation
is_valid_token only checked token presence and age, never whether the cached token actually grants the requested scopes. After adding a scope to OKTA_SCOPES and restarting, the still-fresh cached token was reused and a refresh-token exchange cannot widen scopes, so the new scopes never took effect without manually deleting the keyring entries. Decode the access token's scp/scope claim (no signature verification) and treat the token as invalid when a requested okta.* scope is absent, forcing a fresh device grant that re-requests the full scope set. OIDC/base scopes are excluded from the comparison since Okta does not echo them in the access token, and non-JWT tokens fall back to the existing age and 401/403 handling.
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
is_valid_tokendecided validity from token presence and age only, never comparing the requestedOKTA_SCOPESto the scopes the cached token carries — so newly added scopes silently never took effect (a refresh exchange cannot widen scopes). This decodes the access token'sscp/scopeclaim and forces a fresh device grant when a requestedokta.*scope is missing. OIDC/base scopes are excluded from the comparison, and a one-shot guard prevents a re-auth loop when a scope was never granted to the app.\n\nTests:tests/test_auth_manager.py.