upstream/keycloak
1
0
Fork 0
mirror of https://github.com/keycloak/keycloak.git synced 2026-05-28 04:13:22 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge eed591f0b9 into 94dcc24a8d

Browse source
This commit is contained in:
lx277856602 2026-05-25 05:32:29 +09:00 committed by GitHub
commit 59a3a70eed
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 21 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java
View file

@ -324,6 +324,27 @@ public abstract class AbstractOAuth2IdentityProvider<C extends OAuth2IdentityPro
}
if (Booleans.isTrue(getConfig().isStoreToken())) {
// Fix: Check token expiration and refresh if needed before returning the token
// This addresses the issue where external IDP tokens are not refreshed automatically
FederatedIdentityModel model = session.users().getFederatedIdentity(session.getContext().getRealm(), user, getConfig().getAlias());
if (model != null && model.getToken() != null && model.getToken().startsWith("{")) {
try {
OAuthResponse previousResponse = JsonSerialization.readValue(model.getToken(), OAuthResponse.class);
Long exp = previousResponse.getAccessTokenExpiration();
if (needsRefresh(exp) && previousResponse.getRefreshToken() != null) {
OAuthResponse newResponse = refreshToken(previousResponse, session);
if (newResponse.getExpiresIn() != null && newResponse.getExpiresIn() > 0) {
long accessTokenExpiration = Time.currentTime() + newResponse.getExpiresIn();
newResponse.setAccessTokenExpiration(accessTokenExpiration);
}
model.setToken(JsonSerialization.writeValueAsString(newResponse));
session.users().updateFederatedIdentity(session.getContext().getRealm(), user, model);
}
} catch (IOException e) {
logger.warnf(e, "Unable to refresh token for user %s and provider %s", user.getId(), getConfig().getAlias());
// Continue with existing token if refresh fails
}
}
response = exchangeStoredToken(uriInfo, null, null, userSession, user);
}