// Refresh renews a user's session using an oid refresh token without reprompting the user.
// Group membership is also refreshed. If configured properly, Okta is we can configure the access token
// to include group membership claims which allows us to avoid a follow up oauth2 call.
Refresh renews a user's session using an oid refresh token without reprompting the user.
Group membership is also refreshed. If configured properly, Okta is we can configure the access token
to include group membership claims which allows us to avoid a follow up oauth2 call.
// Refresh renews a user ' s session using an oid refresh token without reprompting the user . // Group membership is also refreshed . If configured properly Okta is we can configure the access token // to include group membership claims which allows us to avoid a follow up oauth2 call .
func (p *OktaProvider) Refresh(ctx context.Context, s *sessions.SessionState) (*sessions.SessionState, error) {
	if s.RefreshToken == "" {
		return nil, errors.New("identity/okta: missing refresh token")
	}
	t := oauth2.Token{RefreshToken: s.RefreshToken}
	newToken, err := p.oauth.TokenSource(ctx, &t).Token()
	if err != nil {
		log.Error().Err(err).Msg("identity/okta: refresh failed")
		return nil, err
	}
	payload, err := parseJWT(newToken.AccessToken)
	if err != nil {
		return nil, fmt.Errorf("identity/okta: malformed access token jwt: %v", err)
	}
	var token accessToken
	if err := json.Unmarshal(payload, &token); err != nil {
		return nil, fmt.Errorf("identity/okta: failed to unmarshal access token claims: %v", err)
	}
	if len(token.Groups) != 0 {
		s.Groups = token.Groups
	}
	s.AccessToken = newToken.AccessToken
	s.RefreshDeadline = newToken.Expiry.Truncate(time.Second)
	return s, nil
}
func ( p * OktaProvider ) Refresh ( ctx context . Context , s * sessions . SessionState ) ( * sessions . SessionState , error ) { if s . RefreshToken == " " { return nil , errors . New ( " " ) } t := oauth2 . Token { RefreshToken : s . RefreshToken } newToken , err := p . oauth . TokenSource ( ctx , & t ) . Token ( ) if err != nil { log . Error ( ) . Err ( err ) . Msg ( " " ) return nil , err } payload , err := parseJWT ( newToken . AccessToken ) if err != nil { return nil , fmt . Errorf ( " " , err ) } var token accessToken if err := json . Unmarshal ( payload , & token ) ; err != nil { return nil , fmt . Errorf ( " " , err ) } if len ( token . Groups ) != 0 { s . Groups = token . Groups } s . AccessToken = newToken . AccessToken s . RefreshDeadline = newToken . Expiry . Truncate ( time . Second ) return s , nil }
Refresh renews a user's session using an oid refresh token without reprompting the user.
Refresh renews a user ' s session using an oid refresh token without reprompting the user .