feat(server): let a client tie its refresh tokens to the session (#4950)

Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>

Author: nabokihms

api/v2/api.pb.go

@@ -23,6 +23,9 @@ message Client {
   // Where the browser may be sent after an RP-initiated logout. A
   // post_logout_redirect_uri that is not listed here is refused.
   repeated string post_logout_redirect_uris = 11;
+  // Whether this client's refresh tokens outlive the browser session that
+  // issued them: "standalone" (the default) or "session".
+  string refresh_token_lifetime = 12;
 }
 
 // ClientInfo represents an OAuth2 client without sensitive information.
@@ -37,6 +40,7 @@ message ClientInfo {
   repeated string sso_shared_with = 8;
   string backchannel_logout_uri = 9;
   repeated string post_logout_redirect_uris = 10;
+  string refresh_token_lifetime = 11;
 }
 
 // GetClientReq is a request to retrieve client details.
@@ -86,6 +90,10 @@ message UpdateClientReq {
     // leaving dex posting logout tokens at something that no longer exists.
     optional string backchannel_logout_uri = 8;
     repeated string post_logout_redirect_uris = 9;
+    // Optional for the same reason as backchannel_logout_uri: an empty value has
+    // to be tellable apart from "leave it alone" to put a client back on the
+    // default lifetime.
+    optional string refresh_token_lifetime = 10;
 }
 
 // UpdateClientResp returns the response from updating a client.

api/v2/api.proto

@@ -131,6 +131,12 @@ func (c Config) Validate() error {
 		return err
 	}
 
+	for _, client := range c.StaticClients {
+		if err := storage.ValidateRefreshTokenLifetime(client.RefreshTokenLifetime); err != nil {
+			return fmt.Errorf("staticClients: client %q: %w", client.ID, err)
+		}
+	}
+
 	return nil
 }
 

cmd/dex/config.go

@@ -10,6 +10,7 @@ import (
 	"github.com/ghodss/yaml"
 	"github.com/go-jose/go-jose/v4"
 	"github.com/kylelemons/godebug/pretty"
+	"github.com/stretchr/testify/require"
 
 	"github.com/dexidp/dex/connector/mock"
 	"github.com/dexidp/dex/connector/oidc"
@@ -68,6 +69,23 @@ func TestInvalidConfiguration(t *testing.T) {
 	}
 }
 
+// TestInvalidRefreshTokenLifetime: a misspelled lifetime must not read as the
+// default, leaving tokens the client wanted bound outliving the session.
+func TestInvalidRefreshTokenLifetime(t *testing.T) {
+	configuration := Config{
+		Issuer:  "http://127.0.0.1:5556/dex",
+		Storage: Storage{Type: "sqlite3", Config: &sql.SQLite3{File: "examples/dex.db"}},
+		Web:     Web{HTTP: "127.0.0.1:5556"},
+		StaticClients: []storage.Client{
+			{ID: "proxy", RefreshTokenLifetime: "sessions"},
+		},
+	}
+
+	err := configuration.Validate()
+	require.Error(t, err)
+	require.Contains(t, err.Error(), `client "proxy"`)
+}
+
 func TestUnmarshalConfig(t *testing.T) {
 	rawConfig := []byte(`
 issuer: http://127.0.0.1:5556/dex

cmd/dex/config_test.go

@@ -614,7 +614,7 @@ func runServe(options serveOptions) error {
 		}
 
 		grpcSrv := grpc.NewServer(grpcOptions...)
-		api.RegisterDexServer(grpcSrv, apiserver.NewAPI(serverConfig.Storage, logger, version, serv.Connectors(), serv.Discovery()))
+		api.RegisterDexServer(grpcSrv, apiserver.NewAPI(serverConfig.Storage, logger, version, serv.Connectors(), serv.Discovery(), serv.Backchannel()))
 
 		grpcMetrics.InitializeMetrics(grpcSrv)
 		if c.GRPC.Reflection {

cmd/dex/serve.go

@@ -166,6 +166,7 @@ func (s *Server) handleAdmin(w http.ResponseWriter, r *http.Request) {
 					SSOSharedWith:          c.SsoSharedWith,
 					BackchannelLogoutURI:   c.BackchannelLogoutUri,
 					PostLogoutRedirectURIs: c.PostLogoutRedirectUris,
+					RefreshTokenLifetime:   c.RefreshTokenLifetime,
 				})
 			}
 		} else {
@@ -279,6 +280,7 @@ func (s *Server) handleAdmin(w http.ResponseWriter, r *http.Request) {
 				SSOSharedWith:          c.SsoSharedWith,
 				BackchannelLogoutURI:   c.BackchannelLogoutUri,
 				PostLogoutRedirectURIs: c.PostLogoutRedirectUris,
+				RefreshTokenLifetime:   c.RefreshTokenLifetime,
 			}
 		} else if err != nil {
 			fail(err)
@@ -328,6 +330,7 @@ func (s *Server) handleAdminCreateClient(w http.ResponseWriter, r *http.Request)
 			SsoSharedWith:          r.Form["sso_shared_with"],
 			BackchannelLogoutUri:   r.FormValue("backchannel_logout_uri"),
 			PostLogoutRedirectUris: r.Form["post_logout_redirect_uris"],
+			RefreshTokenLifetime:   r.FormValue("refresh_token_lifetime"),
 			Public:                 r.FormValue("public") != "",
 		},
 	}
@@ -503,6 +506,7 @@ func (s *Server) handleAdminUpdateClient(w http.ResponseWriter, r *http.Request)
 	// would leave the old one in place, and the box would fill itself back in on
 	// the next load.
 	backchannelLogoutURI := r.FormValue("backchannel_logout_uri")
+	refreshTokenLifetime := r.FormValue("refresh_token_lifetime")
 
 	resp, err := s.admin.api.UpdateClient(ctx, &api.UpdateClientReq{
 		Id:                     id,
@@ -514,6 +518,7 @@ func (s *Server) handleAdminUpdateClient(w http.ResponseWriter, r *http.Request)
 		SsoSharedWith:          r.Form["sso_shared_with"],
 		BackchannelLogoutUri:   &backchannelLogoutURI,
 		PostLogoutRedirectUris: r.Form["post_logout_redirect_uris"],
+		RefreshTokenLifetime:   &refreshTokenLifetime,
 	})
 	switch {
 	case err != nil:

examples/example-app/server/admin.go

@@ -50,6 +50,7 @@ func (s *Server) handleAdminClientDetail(w http.ResponseWriter, r *http.Request)
 			SSOSharedWith:          c.SsoSharedWith,
 			BackchannelLogoutURI:   c.BackchannelLogoutUri,
 			PostLogoutRedirectURIs: c.PostLogoutRedirectUris,
+			RefreshTokenLifetime:   c.RefreshTokenLifetime,
 		}
 	}
 

examples/example-app/server/admindetail.go

@@ -234,6 +234,7 @@ type AdminClient struct {
 	SSOSharedWith          []string
 	BackchannelLogoutURI   string
 	PostLogoutRedirectURIs []string
+	RefreshTokenLifetime   string
 }
 
 // AdminPassword is one local password entry as the API reports it.

examples/example-app/server/render.go

@@ -166,6 +166,16 @@
                 <small class="hint">Where dex POSTs a logout token when a session ends. Empty means this client is never told.</small>
             </div>
         </div>
+        <div class="form-row">
+            <label for="c_refresh_token_lifetime">Refresh token lifetime</label>
+            <div class="form-control">
+                <select id="c_refresh_token_lifetime" name="refresh_token_lifetime">
+                    <option value="standalone">standalone</option>
+                    <option value="session">session</option>
+                </select>
+                <small class="hint">standalone tokens outlive the browser session, which is what keeps a CLI signed in. session tokens stop refreshing the moment that session ends.</small>
+            </div>
+        </div>
         <div class="form-row">
             <label for="c_public">Public</label>
             <div class="form-control">
@@ -267,6 +277,16 @@
                 <small class="hint">Clearing the box removes it, and dex stops sending this client logout tokens.</small>
             </div>
         </div>
+        <div class="form-row">
+            <label for="e_refresh_token_lifetime">Refresh token lifetime</label>
+            <div class="form-control">
+                <select id="e_refresh_token_lifetime" name="refresh_token_lifetime">
+                    <option value="standalone"{{if ne .RefreshTokenLifetime "session"}} selected{{end}}>standalone</option>
+                    <option value="session"{{if eq .RefreshTokenLifetime "session"}} selected{{end}}>session</option>
+                </select>
+                <small class="hint">Switching to session ends this client's refresh tokens with the browser session they came from.</small>
+            </div>
+        </div>
         <p class="note">
             UpdateClient carries no secret and no public flag, so neither can be
             changed: dex expects a client that needs a new secret to be replaced.

examples/example-app/server/templates/admin.html

@@ -31,6 +31,8 @@
         <div class="v mono">{{range .PostLogoutRedirectURIs}}{{.}}<br>{{else}}<span class="hint">none — logout cannot redirect back</span>{{end}}</div>
         <div class="k">Back-channel logout URI</div>
         <div class="v mono">{{if .BackchannelLogoutURI}}{{.BackchannelLogoutURI}}{{else}}<span class="hint">not set — this client is not notified when a session ends</span>{{end}}</div>
+        <div class="k">Refresh token lifetime</div>
+        <div class="v mono">{{if eq .RefreshTokenLifetime "session"}}session — refreshing stops when the browser session ends{{else}}standalone — refresh tokens outlive the browser session{{end}}</div>
     </div>
     <div class="form-actions">
         <a href="/admin?section=clients&amp;mode=edit&amp;edit={{.ID}}" class="button button-primary">Edit</a>