sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(oidc_auth): Fix userinfo cache expiration logic

Browse Source 
When the userinfo claims store in the usercache is found to be expired,
do not return an error but ignore the cached entry and force a
re-verification of the access token (either via parsing the JWT again or
via a UserInfo lookup).
This is required for setups with non-JWT access tokes where the expiry
date set in the cached claims does not reflect the actual token expiry,
but just the CacheTTL.

Fixes: #1493
This commit is contained in:
Ralf Haferkamp
2026-02-19 13:17:17 +01:00
committed by Ralf Haferkamp
parent 212846f2f4
commit 6dde2839df
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/proxy/pkg/middleware/oidc_auth.go
+5 -5
View File
@@ -8,7 +8,6 @@ import (
"strings" "strings"
"time" "time"
"github.com/golang-jwt/jwt/v5"
"github.com/opencloud-eu/opencloud/pkg/log" "github.com/opencloud-eu/opencloud/pkg/log"
"github.com/opencloud-eu/opencloud/pkg/oidc" "github.com/opencloud-eu/opencloud/pkg/oidc"
"github.com/pkg/errors" "github.com/pkg/errors"
@@ -68,12 +67,13 @@ func (m *OIDCAuthenticator) getClaims(token string, req *http.Request) (map[stri
if len(record) > 0 { if len(record) > 0 {
if err = msgpack.Unmarshal(record[0].Value, &claims); err == nil { if err = msgpack.Unmarshal(record[0].Value, &claims); err == nil {
m.Logger.Debug().Interface("claims", claims).Msg("cache hit for userinfo") m.Logger.Debug().Interface("claims", claims).Msg("cache hit for userinfo")
if ok := verifyExpiresAt(claims, m.TimeFunc()); !ok { if verifyExpiresAt(claims, m.TimeFunc()) {
return nil, false, jwt.ErrTokenExpired return claims, false, nil
} }
return claims, false, nil m.Logger.Debug().Msg("cached userinfo claims expired, ignoring cache")
} else {
m.Logger.Error().Err(err).Msg("failed to unmarshal cached userinfo, ignoring cache")
} }
m.Logger.Error().Err(err).Msg("could not unmarshal userinfo")
} }
aClaims, claims, err := m.oidcClient.VerifyAccessToken(req.Context(), token) aClaims, claims, err := m.oidcClient.VerifyAccessToken(req.Context(), token)