You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "hcldan (via GitHub)" <gi...@apache.org> on 2026/07/24 19:56:31 UTC
[I] bug: openid-connect plugin does not refresh access token when end server responds with 401 [apisix]
hcldan opened a new issue, #13750:
URL: https://github.com/apache/apisix/issues/13750
### Current Behavior
I understand that the openid-connect plugin does not have support for back-channel logout... our service behind the plugin does support this and knows when a user logs out or token is revoked.
Right now we have requests going through a route configured with the plugin. Authentication happens normally, the user is redirected to the IDP and then the session is created with a cookie and everything works.
The problem is after the user logs out by other means. Our backend server gets notified of the logout and considers the users access token invalid.
When a request happens again through the route with the plugin, we return a 401 from the backend server and the 401 is returned through the route instead of the openid-connect plugin trying to acquire a new token.
This is noticeable when the user logs back in, the route is broken for them until the access token it had eventually expires.
Or when the user logs in as someone else, the same thing happens.
### Expected Behavior
We expect the openid-connect plugin to try to get a new access token if the token it has results in a 401 where it is being used.
### Error Logs
_No response_
### Steps to Reproduce
1. configure route with openid-connect plugin
2. log in user with credentials through route
3. invalidate the token through other means (re-log in, or log in as new user)
4. try to access through route again
### Environment
apisix version 2.16.0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: openid-connect plugin does not refresh access token when end server responds with 401 [apisix]
Posted by "hcldan (via GitHub) via notifications" <no...@apisix.apache.org>.
hcldan commented on issue #13750:
URL: https://github.com/apache/apisix/issues/13750#issuecomment-6582784475
> You mentioned that your backend already receives logout notifications. Could you confirm which IdP you use and whether the logout/revocation operations described here can also send a standard OIDC back-channel logout notification to the APISIX client? That will help verify that this approach covers your scenario.
We use HCL Domino's OIDC IDP. It is capable of sending standard back-channel logout notifications to clients registered with the provider. We do this today for other services that support this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: openid-connect plugin does not refresh access token when end server responds with 401 [apisix]
Posted by "Baoyuantop (via GitHub) via notifications" <no...@apisix.apache.org>.
Baoyuantop commented on issue #13750:
URL: https://github.com/apache/apisix/issues/13750#issuecomment-6582511911
I'm taking over the follow-up on this issue. The planned approach is to invalidate the gateway's Cookie session when it receives an OIDC back-channel logout notification from the identity provider.
The next steps are:
1. **Session revocation:** I've submitted [lua-resty-session #215](https://github.com/bungle/lua-resty-session/pull/215), continuing #212, to support revocation by subject or IdP session ID. Local tests and lint pass; upstream review is pending.
2. **OIDC notification handling:** Continue the receiver and logout-token validation work tracked in [lua-resty-openidc #572](https://github.com/zmartzone/lua-resty-openidc/issues/572), using the session library's agreed APIs.
3. **APISIX integration:** Rework the integration tracked in #13808, which is currently a draft, to use those upstream APIs. Then update dependencies and run end-to-end checks for external logout, re-login/user switching, and cross-node revocation, including cache propagation and storage failures.
This plan addresses IdP-driven session invalidation. Automatically refreshing a token or retrying a request after an arbitrary upstream `401` is outside this change.
You mentioned that your backend already receives logout notifications. Could you confirm which IdP you use and whether the logout/revocation operations described here can also send a standard OIDC back-channel logout notification to the APISIX client? That will help verify that this approach covers your scenario.
There is no target release or ETA yet; that depends on upstream review and completion of the integration.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org