Authentik refresh - Fixes #6311 #332

New Issue

MrUnknownDE · 2026-04-05T20:54:55+02:00

MrUnknownDE commented

2026-04-05 20:54:55 +02:00

Originally created by @Ajsmith1435 on 10/14/2025

Fix SSO refresh with Authentik by always adopting the IdP’s rotated refresh token, preventing invalid_grant and premature re-login.

Changes
src/sso_client.rs: exchange_refresh_token always returns Some(current_refresh_token) (rotated if provided, else the one just used).
src/sso.rs: remove fallback to old token; pass the returned token directly to create_auth_tokens.

Why?
Authentik revokes the old refresh token on rotation; reusing it triggers invalid_grant. See

Testing
SSO with Authentik → let access token expire → refresh repeatedly. Expect no invalid_grant; rotated token adopted each cycle.

Refs
Fixes #6311

*Originally created by @Ajsmith1435 on 10/14/2025* Fix SSO refresh with Authentik by always adopting the IdP’s rotated refresh token, preventing invalid_grant and premature re-login. **Changes** src/sso_client.rs: exchange_refresh_token always returns Some(current_refresh_token) (rotated if provided, else the one just used). src/sso.rs: remove fallback to old token; pass the returned token directly to create_auth_tokens. Why? Authentik revokes the old refresh token on rotation; reusing it triggers invalid_grant. See Testing SSO with Authentik → let access token expire → refresh repeatedly. Expect no invalid_grant; rotated token adopted each cycle. Refs Fixes #6311

MrUnknownDE closed this issue

2026-04-05 20:54:55 +02:00

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#332