CyberDuck Permissions?

[alvinTXRH]

I am working on setting up an EntraID SSO to Cyberduck and my security team is asking why there is the need for this set of permissions:
"Maintain access to data you have given it access to
Allows the app to see and update the data you gave it access to, even when users are not currently using the app. This does not give the app any additional permissions.

This is a permission requested to access your data in [redacted]."

This seems a little excessive. Can anyone shed light on this? I have not been able to email the support team at Cyberduck.

[dkocher]

The offline_access scope ¹ is required to obtain a refresh token. Otherwise, the user would need to start a new OAuth flow every time when connecting.

Footnotes

1. https://learn.microsoft.com/en-us/entra/identity-platform/scopes-oidc#the-offline_access-scope ↩