move keycloak
add ping federate and azure
edit text (possibly placeholders for now - I want to see how it all relates and edit it again. right now, there's a note about the same thing in every section in way that's not super helpful/necessary)
~~convert some paragraphs to OL~~ calling this out of scope for now

add offline_access scope

56158b8

EdwardAngert self-assigned this

Jun 11, 2025

EdwardAngert added the docsArea: coder.com/docs label

Jun 11, 2025

md fixes and lots of offline_access notes

566fe99

EdwardAngert force-pushed the18307-refresh-tokens branch fromff568a1 to566fe99Compare

June 11, 2025 20:54

Copy link

Member

Emyrk commentedJun 11, 2025

preview (not sure why@Emyrk 's photo is so huge there though)

Yea, can we make my photo much smaller lol

Copy link

Collaborator

sreya commentedJun 12, 2025

Yeah this is currentlydeployed lol. As handsome as@Emyrk is, can we remove the avatar?

Copy link

ContributorAuthor

EdwardAngert commentedJun 12, 2025

ooph thanks for catching@sreya

fixed by#18338

Copy link

Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I think this corresponds to

CODER_OIDC_AUTH_URL_PARAMS='{"access_type": "offline"}'

which might be helpful as an example

Copy link

Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

@spikecurtis from what I can tell, we always add this.

coder/coderd/httpmw/oauth2.go

Line 45 in3ddc7a9

opts=append(opts,oauth2.AccessTypeOffline)

Regardless of your config

Copy link

Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

It defaults, but an explicit value inCODER_OIDC_AUTH_URL_PARAMS overrides it.

docs/admin/users/oidc-auth/refresh-tokens.md OutdatedShow resolvedHide resolved

docs/admin/users/oidc-auth/refresh-tokens.md Outdated


		###Refresh Tokens Not Working After Configuration Change

		Symptoms: Hourly timeouts, even after adding`offline_access`

Copy link

Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

So, aftersuccessfully configuring refresh tokens, users will get logged out early up to one more time. Once they reauthenticate they should get the refresh token---so if users are continuing to get "hourly timeouts" (plural), then refresh tokens are still misconfigured.

Copy link

ContributorAuthor

EdwardAngertJun 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

added:

Users might get logged out again before the new configuration takes effect completely.

L176

but I'm about to move it to the end of the next FAQ

Copy link

Member

EmyrkJun 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

We actually had this same problem for external auth awhile back. Debugging it was a challenge, so I added this to the UI to indicate if refresh is enabled. Maybe we should do something similar for the prrimary auth

Copy link

Contributor

spikecurtisJun 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

@Emyrk yeah, it would be very helpful. Added#18384

docs/admin/users/oidc-auth/refresh-tokens.md OutdatedShow resolvedHide resolved

docs/admin/users/oidc-auth/refresh-tokens.md Outdated


		1. Check that`offline_access` is included in your`CODER_OIDC_SCOPES`
		1. Verify users can stay logged in beyond Okta's access token lifetime (typically one hour)
		1. Monitor Coder logs for any OIDC refresh errors during token renewal

Copy link

Contributor

spikecurtisJun 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

If they have access to the database, and it is not encrypted, then they can check theuser_links table and verify that there are entries in theoauth_refresh_token column.

Getting these instructions doesn't need to block merging.

Copy link

Member

EmyrkJun 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I think we should add something produce side in the UI that could tell if refresh is enabled at least on a per user basis.

add azure and pf, reorg doc

d951736

EdwardAngert commented

Jun 13, 2025

View reviewed changes

docs/admin/users/oidc-auth/refresh-tokens.mdShow resolvedHide resolved

docs/admin/users/oidc-auth/refresh-tokens.md OutdatedShow resolvedHide resolved

docs/admin/users/oidc-auth/refresh-tokens.md Outdated


		###Refresh Tokens Not Working After Configuration Change

		Symptoms: Hourly timeouts, even after adding`offline_access`

Copy link

ContributorAuthor

EdwardAngertJun 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

added:

Users might get logged out again before the new configuration takes effect completely.

L176

but I'm about to move it to the end of the next FAQ

EdwardAngert added6 commits

June 13, 2025 18:09

token config troubleshooting clarify

0438aad

md lint ignore heading levels

bbbd751

remove from idp-sync

2618ffa

add configure section to oidc-auth

4dedaf1

Merge branch 'main' into 18307-refresh-tokens

5d863cc

relative links

2ef836d

EdwardAngert marked this pull request as ready for review

June 13, 2025 18:59

EdwardAngert requested a review fromsreya

June 13, 2025 18:59

EdwardAngert requested review fromEmyrk andspikecurtis

June 13, 2025 18:59

remove note because it doesn't like being nested

f737eb5

spikecurtis approved these changes

Jun 16, 2025

View reviewed changes

Emyrk approved these changes

Jun 16, 2025

View reviewed changes

docs/admin/users/oidc-auth/refresh-tokens.md OutdatedShow resolvedHide resolved

EdwardAngert added2 commits

June 16, 2025 16:35

Merge branch 'main' into 18307-refresh-tokens

6ad5822

separate general/google in troubleshooting

1984341

EdwardAngert dismissedsreya’sstale review

June 16, 2025 17:18

file moved; changes incorporated

EdwardAngert merged commit5c16079 intomain

Jun 16, 2025

32 checks passed

EdwardAngert deleted the 18307-refresh-tokens branch

June 16, 2025 17:18

github-actionsbot locked and limited conversation to collaborators

Jun 16, 2025

Labels

docs

Area: coder.com/docs

4 participants


		By combining the`{"access_type":"offline"}` parameter in the OIDC Auth URL with
		the`offline_access` scope, you can achieve the desired behavior of obtaining
		refresh tokens for offline access to the user's resources.

Movatterモバイル変換

docs: add more specific steps and information about oidc refresh tokens#18336

docs: add more specific steps and information about oidc refresh tokens#18336

Uh oh!

Conversation

EdwardAngert commentedJun 11, 2025• editedLoading Uh oh!There was an error while loading.Please reload this page.

Uh oh!

Uh oh!

Emyrk commentedJun 11, 2025

Uh oh!

sreya commentedJun 12, 2025

Uh oh!

EdwardAngert commentedJun 12, 2025

Uh oh!

sreya commentedJun 12, 2025

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

EdwardAngert commentedJun 11, 2025•
edited
Loading