From a34dae549b345986768ccf2646389e81e590a3a6 Mon Sep 17 00:00:00 2001 From: Ryan Richard Date: Wed, 13 Oct 2021 14:05:00 -0700 Subject: [PATCH] When performing an upstream refresh, use the configured http client Otherwise, the CA and proxy settings will not be used for the call to the upstream token endpoint while performing the refresh. This mistake was exposed by the TestSupervisorLogin integration test, so it has test coverage. --- internal/upstreamoidc/upstreamoidc.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/internal/upstreamoidc/upstreamoidc.go b/internal/upstreamoidc/upstreamoidc.go index 34c27be22..7d4006c88 100644 --- a/internal/upstreamoidc/upstreamoidc.go +++ b/internal/upstreamoidc/upstreamoidc.go @@ -123,9 +123,11 @@ func (p *ProviderConfig) ExchangeAuthcodeAndValidateTokens(ctx context.Context, } func (p *ProviderConfig) PerformRefresh(ctx context.Context, refreshToken string) (*oauth2.Token, error) { + // Use the provided HTTP client to benefit from its CA, proxy, and other settings. + httpClientContext := coreosoidc.ClientContext(ctx, p.Client) // Create a TokenSource without an access token, so it thinks that a refresh is immediately required. // Then ask it for the tokens to cause it to perform the refresh and return the results. - return p.Config.TokenSource(ctx, &oauth2.Token{RefreshToken: refreshToken}).Token() + return p.Config.TokenSource(httpClientContext, &oauth2.Token{RefreshToken: refreshToken}).Token() } // ValidateToken will validate the ID token. It will also merge the claims from the userinfo endpoint response,