Save OIDC tokens to OpenProject database

[ba1ash]

Ticket

https://community.openproject.org/wp/58365

What are you trying to accomplish?

Storing access and refresh tokens for users that initiate their session through OIDC, so that we can later use them to obtain tokens for accessing third party resources, such as Nextcloud.

What approach did you choose and why?

Storing the access and refresh token on a new table that is intended to store all access tokens for the current session's user, including the ones later obtained through Token Exchange. This provides a clear place to look for credentials and additionally keeps the back-channel logout logic separated from token storage (as opposed to storing the tokens on the user_session_link.

Merge checklist

• Added/updated tests
• Added/updated documentation in Lookbook (patterns, previews, etc)
• Tested major browsers (Chrome, Firefox, Edge, ...)

[NobodysNightmare]

An alternative approach to storing the tokens on the UserSessionLinks table might be to associate another table to the session that specifically stores tokens only.

In general, we are not done yet: One next step will be to write code that can take a valid access token stored here and exchange it through OAuth 2.0 Token Exchange for a token that can be used to access a third party service. Eventually there will be multiple third party services, that we want to exchange tokens for and then we want to reuse those tokens until they expire.

This means we could store all of those tokens in the same table (e.g. with an additional audience column) along with our own tokens. I'd prefer this approach for storing all tokens the same way. On the other hand, some special logic will be required, since for token exchange we will always want to use our own tokens to perform the exchange.

[NobodysNightmare]

I did what I suggested above. This PR now contains both, the original version (check the diff of commit 1) and the one suggested by me (check the diff of the total PR). My personal prefererence is the current version of this PR.

[NobodysNightmare]

One other thought that crossed my mind today and was then repeated by @wielinde:

Should we store the tokens on the session or on the user?

Arguments against session:

• We'd have to push the correct session into all storage-services, instead of pushing the user there
• A session is harder to obtain than a user (imagine calling a service from a background worker)

The argument for session:

• Right now we obtain the tokens in the context of an SSO session, so they may be affected by IDP logout
  • thus it's not safe to use tokens from arbitrary sessions
  • but maybe we can obtain a token for long-term offline use instead? (that could be bound to user safely)

[NobodysNightmare]

but maybe we can obtain a token for long-term offline use instead? (that could be bound to user safely)

For Keycloak in default config, this is possible by adding the offline_access scope to the list of requested scopes. This will make sure that the lifetime of refresh tokens is not limited and they are not revoked after logout anymore.

So we could attach tokens to the user instead of the session, if we can ensure that they are not expiring. I see elevated potential for misconfiguration here, but on the other hand it still sounds like the cleanest available solution to me.

edit: However, seeing that offline_access is a standardized scope name, we could make sure that there is a properly configured OIDC provider available...