OpenId Refresh token is not passed as container variable

[rutgerzoontjens]

Hi,
I am trying to pass the Refresh Token variable to a pod, but have not yet been successful.

Setup:

Shinyproxy 2.6.0 running in a pod on an Azure Kubernetes cluster
Openid authentication
Scope: {appid}/.default
the container variable is added to the app in the application yml:
container-env: SHINYPROXY_REFRESH_TOKEN: “#{oidcUser.refreshToken}”

Problem is that the Refresh Token value stays empty when running the pod.

Does anyone know how to fix this?

Thanks in advance!
Rutger

[LEDfan]

Hi

Recently, we are getting more reports of issues with this feature, although we are using it in many deployments ourselves, without any issue. Because this issue is harder to debug, I created a special snapshot of ShinyProxy with a few changes in order to make things easier.

Can you try deploying this Docker image openanalytics/shinyproxy-snapshot:2.6.1-SNAPSHOT-20220516.085208 and provide the answers to these steps/questions:

1. go to the page /debug-spel on your shinyproxy server, e.g. https://shinyproxy-demo.local/debug-spel. This page shows a JSON serialization of all objects that can be used in the SpEL expressions. For example, when using OIDC, it should show a non-null oidcUser object.
2. check whether this object contains the properties you are trying to access. For example, in the case of @rutgerzoontjens this will be the refreshToken property. Please report back whether this property is included in this object or not.
3. try opening an app for which you have the SpEL config defined. In the logs of ShinyProxy, you now should see something like:

2022-05-16 07:00:41.799  INFO 1 --- [  XNIO-1 task-1] e.o.c.s.e.SpecExpressionResolver         : Resolved SpEL expression:
	INPUT:	#{oidcUser.refreshToken}
	OUTPUT:	eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUI

4. Please provide me with these logs (remove any sensitive values). You can check already whether the output contains the correct expression.
5. Provide me with the following additional information:

• Identity Provider (e.g. Keycloak, Azure AD, Okta ...)
• Which container backend you are using (Docker, Docker swarm, Kubernetes). Please report the version as well.
• Are you always experiencing the issue, or does it sometimes work?
• Provide your full application.yml, you can strip out any non-relevant apps or sensitive values. But since I cannot reproduce the issue, I'm starting to think there may be some issue in the config (or parsing of it).

Let's hope we can resolve this issue using the provided information!

[LEDfan]

Hi @rutgerzoontjens , we noticed that for Azure B2C you need add the specify the offline_access scope in order to get a refresh token. Can you try this out? See openanalytics/shinyproxy#464

[rutgerzoontjens]

Hi Tobia, Yes, it works! Rutger Op di 2 jan 2024 om 09:58 schreef Tobia De Koninck ***@***.***

…

: Hi @rutgerzoontjens <https://github.com/rutgerzoontjens> , we noticed that for Azure B2C you need add the specify the offline_access scope in order to get a refresh token. Can you try this out? See openanalytics/shinyproxy#464 <openanalytics/shinyproxy#464> — Reply to this email directly, view it on GitHub <#65 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AP5ZU2G2TD64ACNYFMZQGPTYMPD37AVCNFSM5VRXJS32U5DIOJSWCZC7NNSXTN2JONZXKZKDN5WW2ZLOOQ5TCOBXGM3TKNBYHEYQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[LEDfan]

That's great news! Since I think the problem is solved now, I'm going to close this issue. Feel free to open a new issue in case you have any problems or suggestions.