OidcUsermanger.currentuser returns null after some few days or hours

[Ianmuhia]

After login in , quering the current user returns null after some hours , or days

[ahmednfwela]

perhaps the access token expired and no refresh token was provided by the idp?

check if you requested offline_access scope

[egfconnor]

I am seeing the same behavior even though I have a refresh token I'm getting back.

What's interesting is if I log the expiresIn from the currentUser's token it always shows it expires in 74 minutes even as time is passing by. Perhaps the auto refresh isn't working because of an issue with the logic that calculates the expiresIn duration?

[ahmednfwela]

@egfconnor expiresIn does not change as time passes, it's instead added to expiresInReferenceDate to get the expiresAt date, where we check if it has passed now or not

[ahmednfwela]

please provide your idp discovery document if possible

[egfconnor]

@ahmednfwela ah okay that makes more sense then. My idp discovery document includes offline_access in the scopes_supported section if that's what you're wondering about? I also specify that in my scope array in OidcUserManagerSettings.

[egfconnor]

Is there any ways you would recommend I could debug if it's attempting to refresh or not? I can use Flutter Dev Tools Network panel for instance to observe specific network requests, or enable some sort of log?

[ahmednfwela]

can you also check the supported grants in the discovery document if they include refresh token?

[egfconnor]

Thanks for the help @ahmednfwela it turns out my discovery document for Microsoft Entra doesn't include a 'grant_types_supported' section at all. I manually added it via OidcProviderMetadata.fromJson() and refresh is working great now.

[ahmednfwela]

that's great to hear @egfconnor !

[Ianmuhia]

@egfconnor .. mind providing a code sample for your solution please

[egfconnor]

  final OidcUserManager _oidcUserManager = OidcUserManager(
    discoveryDocument: OidcProviderMetadata.fromJson(
      {
        'issuer':
            '<issuer>',
        'authorization_endpoint':
            '<authorization_endpoint>',
        'token_endpoint':
            '<token_endpoint>',
        'end_session_endpoint':
            '<end_session_endpoint>',
        'grant_types_supported': [
          'authorization_code',
          'refresh_token',
        ],
      },
    ),
    clientCredentials: const OidcClientAuthentication.none(
      clientId: '<client_id>',
    ),
    store: OidcDefaultStore(),
    settings: OidcUserManagerSettings(
      prompt: ['login'],
      scope: ['openid', 'offline_access', '<a_custom_scope_we_have>'],
      options: const OidcPlatformSpecificOptions(
        ios: OidcPlatformSpecificOptions_AppAuth_IosMacos(
          // This disables "app_name" Wants to Use "domain_name" to Sign In on iOS
          preferEphemeralSession: true,
        ),
      ),
      redirectUri: Uri.parse('<our_redirect_uri>'),
      supportOfflineAuth: true,
    ),
  );

Then of course you need to call:

 await _oidcUserManager.init();

[ahmednfwela]

another option is to also override the discovery document

https://bdaya-dev.github.io/oidc/oidc-usage/#overriding-the-discovery-document