Now, when an authorization code is exchanged for an access token, the response might contains a refresh token [0]. The refresh token is only set when the authorization request was made with the offline_access scope per the OpenID Connect Core specification [1]. To test (if app force the usage of PKCE you need to add the required parameters to the following instructions): 1. In the project admin create an OAuth2 app (note the ID and the given secret) 2. Access the authorize page at the URL https://tuleap.example.com/oauth2/authorize?client_id=<client_id>&scope=offline_access&response_type=code&redirect_uri=<redirect_uri> 3. Quickly retrieve (it is valid only 1 minute) the authorization code from the URL 4. Exchange the authorization code for an access token: shell> curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' \ --user '<client_id>:<client_secret>' \ --data 'grant_type=authorization_code&redirect_uri=<redirect_uri>&code=<authorization_code>' \ https://tuleap.example.com/oauth2/token 5. The response should contain a refresh token. The refresh token should also be saved in the DB. This is part of story #14542: have OAuth2 flow [0] https://tools.ietf.org/html/rfc6749#section-6 [1] https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess Change-Id: I7ff4d66375aad1d29b628f938e00924248170452

+856 −24

Author

Thomas Gerbet (tgerbet) 2020-03-20 16:52

Committer

Thomas Gerbet (tgerbet) 2020-03-23 11:31

Hash 4e42ec0b07cfb07a12f7b35d34237b5084c64975

Parent 76201f3cc0c113fb718c44bdcc7aaa5e1d90a9de

Reference git #tuleap/stable/4e42ec0b07cfb07a12f7b35d34237b5084c64975