[PR #6360] [CLOSED] Authentik refresh - Fixes #6311 #12628

New Issue

Closed

opened 2026-04-20 15:53:29 -05:00 by GiteaMirror · 0 comments

GiteaMirror commented 2026-04-20 15:53:29 -05:00

Owner

Copy Link

📋 Pull Request Information

Original PR: https://github.com/dani-garcia/vaultwarden/pull/6360
Author: @Ajsmith1435
Created: 10/14/2025
Status: ❌ Closed

Base: main ← Head: authentik-refresh

---

📝 Commits (2)

• e16a242 sso(authentik): always surface current provider refresh token from exchange
• efa54a4 Update sso.rs - sso(authentik): always adopt rotated provider refresh token to prevent invalid_grant

📊 Changes

2 files changed (+15 additions, -7 deletions)

View changed files

📝 src/sso.rs (+2 -2)
📝 src/sso_client.rs (+13 -5)

📄 Description

Fix SSO refresh with Authentik by always adopting the IdP’s rotated refresh token, preventing invalid_grant and premature re-login.

Changes
src/sso_client.rs: exchange_refresh_token always returns Some(current_refresh_token) (rotated if provided, else the one just used).
src/sso.rs: remove fallback to old token; pass the returned token directly to create_auth_tokens.

Why?
Authentik revokes the old refresh token on rotation; reusing it triggers invalid_grant. See

Testing
SSO with Authentik → let access token expire → refresh repeatedly. Expect no invalid_grant; rotated token adopted each cycle.

Refs
Fixes #6311

---

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/dani-garcia/vaultwarden/pull/6360 **Author:** [@Ajsmith1435](https://github.com/Ajsmith1435) **Created:** 10/14/2025 **Status:** ❌ Closed **Base:** `main` ← **Head:** `authentik-refresh` --- ### 📝 Commits (2) - [`e16a242`](https://github.com/dani-garcia/vaultwarden/commit/e16a24233c05d932efd57c83d1e0b1ab64859f7d) sso(authentik): always surface current provider refresh token from exchange - [`efa54a4`](https://github.com/dani-garcia/vaultwarden/commit/efa54a419bb6fc6b3d6cea557a4a208101202e62) Update sso.rs - sso(authentik): always adopt rotated provider refresh token to prevent invalid_grant ### 📊 Changes **2 files changed** (+15 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `src/sso.rs` (+2 -2) 📝 `src/sso_client.rs` (+13 -5) </details> ### 📄 Description Fix SSO refresh with Authentik by always adopting the IdP’s rotated refresh token, preventing invalid_grant and premature re-login. **Changes** src/sso_client.rs: exchange_refresh_token always returns Some(current_refresh_token) (rotated if provided, else the one just used). src/sso.rs: remove fallback to old token; pass the returned token directly to create_auth_tokens. Why? Authentik revokes the old refresh token on rotation; reusing it triggers invalid_grant. See Testing SSO with Authentik → let access token expire → refresh repeatedly. Expect no invalid_grant; rotated token adopted each cycle. Refs Fixes #6311 --- _{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

GiteaMirror added the pull-request label 2026-04-20 15:53:29 -05:00

GiteaMirror closed this issue 2026-04-20 15:53:30 -05:00

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

main

revert-7033-patch-1

cached-config-operations

test_dylint

1.36.0

1.35.8

1.35.7

1.35.6

1.35.5

1.35.4

1.35.3

1.35.2

1.35.1

1.35.0

1.34.3

1.34.2

1.34.1

1.34.0

1.33.2

1.33.1

1.33.0

1.32.7

1.32.6

1.32.5

1.32.4

1.32.3

1.32.2

1.32.1

1.32.0

1.31.0

1.30.5

1.30.4

1.30.3

1.30.2

1.30.1

1.30.0

1.29.2

1.29.1

1.29.0

1.28.1

1.28.0

1.27.0

1.26.0

1.25.2

1.25.1

1.25.0

1.24.0

1.23.1

1.23.0

1.22.2

1.22.1

1.22.0

1.21.0

1.20.0

1.19.0

1.18.0

1.17.0

1.16.3

1.16.2

1.16.1

1.16.0

1.15.1

1.15.0

1.14.2

1.14.1

1.14

1.13.1

1.13.0

1.12.0

1.11.0

1.10.0

1.9.1

1.9.0

1.8.0

1.7.0

1.6.1

1.6.0

1.5.0

1.4.0

1.3.0

1.2.0

1.1.0

1.0.0

0.13.0

0.12.0

0.11.0

0.10.0

0.9.0

Labels

Clear labels

better for forum

bug

documentation

duplicate

enhancement

future Vault

good first issue

help wanted

low priority

notes

pull-request

Mirrored from GitHub Pull Request

question

SSO

Third party

troubleshooting

wontfix

No Label pull-request

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

GiteaMirror ninjasurge

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#12628