Support id_token in refresh_token

What version of UAA are you running?

{
  "app": {
    "version": "4.10.0"
  },
  "links": {
    "uaa": "https://uaa.<...>",
    "login": "https://login.<...>"
  },
  "zone_name": "uaa",
  "entityID": "login.<...>",
  "commit_id": "a4132cb",
  "idpDefinitions": {},
  "prompts": {
    "username": [
      "text",
      "Email"
    ],
    "password": [
      "password",
      "Password"
    ]
  },
  "timestamp": "2018-02-06T10:24:36-0800"
}

How are you deploying the UAA?

using cf-deployment 1.15.0 on bosh-lite

What did you do?

I’m trying to integrate UAA and Kubernetes with CFCR 0.14.0 using https://github.com/cloudfoundry-incubator/kubo-release/pull/101 .

It worked to access k8s with id_token returned by UAA. After the token expired, kubctl used refresh_token to refresh the token but failed with the following error

Unable to connect to the server: token response did not contain an id_token, either the scope "openid" wasn't requested upon login, or the provider doesn't support id_tokens as part of the refresh response.

From the doc, refresh token does not seem to support id token.

I’ve also confirmed the response of bellow didn’t contain id_token field

curl -k -v https://uaa.<...>/oauth/token -d client_id=xxxxx -d client_secret=xxxxx -d grant_type=refresh_token -d refresh_token=xxxxx -d response_type=id_token

What did you expect to see? What goal are you trying to achieve with the UAA?

I expected UAA to support id_token in refresh_token in order to refresh token with kubectl.

[tnwang]

Thanks for raising this issue. We are aware of this and will be working on it soon.

[shamus]

Closing due to inactivity.