Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

PXP-7696 Fix/renew access token #874

Merged
merged 6 commits into from
Feb 22, 2021
Merged

PXP-7696 Fix/renew access token #874

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
7f03314
ix: always mint new token
mfshao Feb 12, 2021
5371a69
fix: wrong logic
mfshao Feb 13, 2021
c47e2a6
Merge branch 'master' into fix/renew-access-token
mfshao Feb 18, 2021
bcb24df
fix: add config
mfshao Feb 18, 2021
3bf9f05
run the hook
mfshao Feb 19, 2021
ced7bd4
set default to false
mfshao Feb 19, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .secrets.baseline
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"files": "poetry.lock",
"lines": null
},
"generated_at": "2020-10-22T16:33:03Z",
"generated_at": "2021-02-19T16:52:13Z",
"plugins_used": [
{
"name": "AWSKeyDetector"
Expand Down Expand Up @@ -92,7 +92,7 @@
{
"hashed_secret": "5d07e1b80e448a213b392049888111e1779a52db",
"is_verified": false,
"line_number": 510,
"line_number": 511,
"type": "Secret Keyword"
}
],
Expand Down Expand Up @@ -200,7 +200,7 @@
{
"hashed_secret": "d9db6fe5c14dc55edd34115cdf3958845ac30882",
"is_verified": false,
"line_number": 271,
"line_number": 327,
"type": "Hex High Entropy String"
}
],
Expand Down
4 changes: 3 additions & 1 deletion fence/config-default.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -380,6 +380,8 @@ MAX_ACCESS_TOKEN_TTL: 3600
# auth checks against Arborist, and no longer check the token.
TOKEN_PROJECTS_CUTOFF: 10

# If set to true, will generate an new access token each time when a browser session update happens
RENEW_ACCESS_TOKEN_BEFORE_EXPIRATION: false

########################################################################################
# OPTIONAL CONFIGURATIONS #
Expand Down Expand Up @@ -773,6 +775,6 @@ SERVICE_ACCOUNT_LIMIT: 6
USERSYNC:
sync_from_visas: false
# fallback to dbgap sftp when there are no valid visas for a user i.e. if they're expired or if they're malformed
fallback_to_dbgap_sftp: false
fallback_to_dbgap_sftp: false
visa_types:
ras: [https://ras.nih.gov/visas/v1, https://ras.nih.gov/visas/v1.1]
1 change: 1 addition & 0 deletions fence/config.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ def post_process(self):
"REFRESH_TOKEN_EXPIRES_IN",
"SESSION_TIMEOUT",
"SESSION_LIFETIME",
"RENEW_ACCESS_TOKEN_BEFORE_EXPIRATION",
"GOOGLE_SERVICE_ACCOUNT_KEY_FOR_URL_SIGNING_EXPIRES_IN",
"GOOGLE_USER_SERVICE_ACCOUNT_ACCESS_EXPIRES_IN",
"GOOGLE_ACCOUNT_ACCESS_EXPIRES_IN",
Expand Down
11 changes: 8 additions & 3 deletions fence/resources/user/user_session.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,9 +215,14 @@ def save_session(self, app, session, response):
domain=domain,
)

# if a user is logged in and doesn't have an access token, let's
# generate one
if user and not flask.g.access_token:
# generate an access token and set in cookie if
# user is logged in AND one of the following:
# 1. RENEW_ACCESS_TOKEN_BEFORE_EXPIRATION = true in config
# 2. current access token has expired (no access_token)
if user and (
config.get("RENEW_ACCESS_TOKEN_BEFORE_EXPIRATION")
or not flask.g.access_token
):
_create_access_token_cookie(app, session, response, user)
else:
# If there isn't a session token, we should set
Expand Down