Identity service 4 auto token refresh

Question

I am using identity server 4 with the oidc-client library in an angular 2 web page. The login, logout calls and api calls are all working correctly without any issues. I have recently started trying to get the token auto refresh functionality to work in the web page also. I see that web page defined in silent-redirect is getting created in the iFrame and I see calls to the id4 service but always get a timeout error on the iframe and no new token received. Any help or suggestions on what I am missing or doing wrong would be greatly appreciated. I have included relevant client side code below. I do see the token expiring event being triggered. thanks a lot in advance.

angular2 service

import { UserManager, Log, MetadataService, User, WebStorageStateStore } from 'oidc-client';


export const settings: any = {
  authority: 'http://10.3.30.215:8885',
  client_id: 'tps',
  redirect_uri: 'http://10.3.30.215:4201/auth.html', 
  response_type: 'id_token token',
  automaticSilentRenew: true,
  monitorSession: true,
  scope: 'openid scope1 scope2 offline_access',
  post_logout_redirect_uri: 'http://10.3.30.215:4201', 
  silent_redirect_uri: 'http://10.3.30.215:4201/silent_renew.html',
  loadUserInfo: true

};


  public mgr: UserManager = new UserManager(settings);
constructor(private http: Http) {

    Log.logger = console;
    Log.level = Log.DEBUG;
  }

login() {
       this.mgr.clearStaleState().then(() => {       
        this.mgr.signinRedirect();
        });

}

silent_renew.html:

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
    <title></title>
</head>
<body>
    <script src="oidc-client.js"></script>
    <script>
        new Oidc.UserManager().signinSilentCallback();
    </script>
</body>
</html>

score 0 · Answer 1 · answered Aug 18 '17 at 01:20

Assuming your site is secure with https and you own the frontend, you could possibly do a resource owner password grant implementation with refresh tokens and use angular's built in auth features.

This site has some good info on how to implement an http interceptor. https://ryanchenkie.com/angular-authentication-using-the-http-client-and-http-interceptors.

Your use case might not allow this approach, but it is an option. Hope that helps.

Identity service 4 auto token refresh

1 Answers1