mirror of
https://github.com/int128/kubelogin.git
synced 2026-08-19 10:56:14 +00:00
5aaf30b930
When useAccessToken is enabled, some OIDC providers (e.g. PingFederate) do not return an id_token on refresh_token grants. Previously, verifyToken() unconditionally required id_token before checking the useAccessToken flag, causing every token refresh to fail and fall back to the browser-based authorization code flow. Restructure verifyToken() so that when useAccessToken is enabled, the access token is verified directly and the id_token is only verified if present. The standard id_token flow when useAccessToken is disabled remains unchanged. Fixes int128/kubelogin#536 Signed-off-by: Mathias Zeller <mathias.zeller@mercedes-benz.com> Co-authored-by: Hidetake Iwata <int128@gmail.com>