diff --git a/providers/openidConnect/openidConnect.go b/providers/openidConnect/openidConnect.go index c928547a..6dc75920 100644 --- a/providers/openidConnect/openidConnect.go +++ b/providers/openidConnect/openidConnect.go @@ -8,7 +8,6 @@ import ( "fmt" "io" "net/http" - "net/url" "strings" "time" @@ -276,38 +275,20 @@ func (p *Provider) RefreshToken(refreshToken string) (*oauth2.Token, error) { // compatibility purposes) that also returns the id_token in the OpenID refresh token flow API response // Learn more about ID tokens: https://openid.net/specs/openid-connect-core-1_0.html#IDToken func (p *Provider) RefreshTokenWithIDToken(refreshToken string) (*RefreshTokenResponse, error) { - urlValues := url.Values{ - "grant_type": {"refresh_token"}, - "refresh_token": {refreshToken}, - "client_id": {p.ClientKey}, - "client_secret": {p.Secret}, - } - req, err := http.NewRequest("POST", p.OpenIDConfig.TokenEndpoint, strings.NewReader(urlValues.Encode())) - if err != nil { - return nil, err - } - - req.Header.Set("Content-Type", "application/x-www-form-urlencoded") - - resp, err := p.Client().Do(req) + newToken, err := p.RefreshToken(refreshToken) if err != nil { return nil, err } - if resp.StatusCode != http.StatusOK { - return nil, fmt.Errorf("Non-200 response from RefreshToken: %d, WWW-Authenticate=%s", resp.StatusCode, resp.Header.Get("WWW-Authenticate")) - } - body, err := io.ReadAll(resp.Body) - if err != nil { - return nil, err + idToken, ok := newToken.Extra("id_token").(string) + if !ok || idToken == "" { + return nil, fmt.Errorf("id_token not present in token response") } - resp.Body.Close() - refreshTokenResponse := &RefreshTokenResponse{} - - err = json.Unmarshal(body, refreshTokenResponse) - if err != nil { - return nil, err + refreshTokenResponse := &RefreshTokenResponse{ + AccessToken: newToken.AccessToken, + IdToken: idToken, + RefreshToken: newToken.RefreshToken, } return refreshTokenResponse, nil