Automatic silent renew deletes profile from stored state

Hello,

I noticed that the property profile of the object stored inside the session storage is overwritten when a silent renew is triggered. It looks like the response of the silent renew just overwrites the whole object.

State stored in session storage after signin with redirect callback:

State stored in session storage after first silent renew:

I also enabled the option loadUserInfo of the UserManager, but the silent renew doesn’t seem to respect it. It would be great if the stored profile would remain in place even after the silentRenew.

[pamapa]

Idea: We could remove:

if (!response.isOpenId) {
  logger.debug("response is not OIDC, skipping claims processing");
  return;
}

and change the “if” code to:

if (response.isOpenId && claims.sub !== response.profile.sub) {
  logger.throw(new Error("subject from UserInfo response does not match subject in ID Token"));
}

_filterProtocolClaims should be fine for !isOpenId…

[kherock]

The reason that hacking openid back onto the scope returned in the response isn’t ideal is given here: https://www.oauth.com/oauth2-servers/access-tokens/refreshing-access-tokens/

The requested scope must not include additional scopes that were not issued in the original access token. Typically this will not be included in the request, and if omitted, the service should issue an access token with the same scope as was previously issued.

I think the better behavior here might be to simply discard the scope sent back from the IDP and just preserve the scope used in the original request?