[lorenzocorallo]

Problem

Flux Web and Grafana log people out after about 5 minutes, even though "stays signed in" is ticked for both apps in the auth admin.

Cause

Ticking "stays signed in" in the auth admin only allows an app to ask for the offline_access scope. The app still has to request it. Neither app does:

• Flux Web: scopes: [openid, profile, email, "polinetwork:identity"]. Setting scopes replaces Flux's defaults, and the defaults include offline_access.
• Grafana: the scopes in its Generic OAuth settings are openid profile email polinetwork:identity.

Without offline_access, auth.polinetwork.org issues no refresh token. Access and ID tokens last 5 minutes. When they expire, both apps have nothing to refresh with, so they end the session.

I checked this against the IdP with a local test: the same client gets no refresh token without offline_access. With it, it gets one, and refreshing returns a new access token, refresh token and ID token.

Fix

Add offline_access to the Flux Web scopes. The IdP needs PKCE or a nonce for offline_access; Flux Web already sends both. It watches this secret and reloads, so no restart is needed.

Also needed (not in git)

• Grafana: in Administration → Authentication → Generic OAuth, add offline_access to Scopes and save. "Use refresh token" and "Use PKCE" are already on.
• IdP: make sure "stays signed in" is ticked and saved for both the Grafana and Flux Web applications in auth.polinetwork.org. If it isn't, sign-in fails with invalid_scope.
• Users have to sign in once more after the change, and accept the consent screen again, to get a refresh token.
• fix(auth): answer concurrent refreshes of one token instead of refusing them auth#71 fixes the IdP refusing concurrent refreshes of one token, which Flux Web does on page load. Without it, Flux can still sign people out every few minutes.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 688bfa75-c3fb-4a71-9a23-43841184c546

Commits

Reviewing files that changed from the base of the PR and between 389d4df and 28a4d09.

Files selected for processing: 1

• infrastructure/flux-web/external-secret.yaml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

The OAuth2 scope list adds offline_access. Comments describe its refresh-token behavior and state that the session ends when the 5-minute ID token expires without it.

Changes

OAuth2 scope configuration

Layer / File(s)	Summary
Add offline access scope infrastructure/flux-web/external-secret.yaml	The scope list adds offline_access. Comments describe its refresh-token behavior and session expiration without the scope.

Priority: Normal

Change: Bug fix

Merge Risk: Minimal · up to 28a4d

The requested OAuth2 scope is added without removing existing scopes, so the change is ready to merge.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: adding the offline_access scope so Flux Web sessions can refresh.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}