How to use GitHub
- Please use the 馃憤 reaction to show that you are interested into the same feature.
- Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
- Subscribe to receive notifications on status change and new comments.
Feature request
Which Nextcloud Version are you currently using: 34.0.2
Is your feature request related to a problem? Please describe.
With #1384 implemented, tokens are periodically refreshed. However, if the token claim values change (for example: different name, email, group assignment), the values aren't updated in Nextcloud.
Describe the solution you'd like
To me it would make sense to update the user attributes when the token is refreshed. That would allow for reasonably fast group membership propagation from the idP, which is actually what I'm ultimately after.
I'm not really sure about how this would work with updates that happen while a user is actively interacting with a resource that they lose access to when a group change happens. Should they be redirected? Maybe an error message? I guess that might already be handled by Nextcloud core...
Describe alternatives you've considered
I've tried to set this up by setting the Nextcloud session_lifetime relatively low (like 5 minutes) and disabling the nextcloud login cookie, however, that seems to fully log me out of the idP after 5 minutes of inactivity. By the looks of it thats because TokenInvalidatedListener calls the end_session_endpoint, which seems to be the same endpoint called for user-initiated single logout (if configured). This method would only work after the idle timeout is triggered, so any changes made in the idP would not be propagated until the user idles anyway.
#1449 seems related, but I'm not actually experiencing that issue.
Additional context
I'm using Keycloak as idP.
How to use GitHub
Feature request
Which Nextcloud Version are you currently using: 34.0.2
Is your feature request related to a problem? Please describe.
With #1384 implemented, tokens are periodically refreshed. However, if the token claim values change (for example: different name, email, group assignment), the values aren't updated in Nextcloud.
Describe the solution you'd like
To me it would make sense to update the user attributes when the token is refreshed. That would allow for reasonably fast group membership propagation from the idP, which is actually what I'm ultimately after.
I'm not really sure about how this would work with updates that happen while a user is actively interacting with a resource that they lose access to when a group change happens. Should they be redirected? Maybe an error message? I guess that might already be handled by Nextcloud core...
Describe alternatives you've considered
I've tried to set this up by setting the Nextcloud
session_lifetimerelatively low (like 5 minutes) and disabling the nextcloud login cookie, however, that seems to fully log me out of the idP after 5 minutes of inactivity. By the looks of it thats becauseTokenInvalidatedListenercalls theend_session_endpoint, which seems to be the same endpoint called for user-initiated single logout (if configured). This method would only work after the idle timeout is triggered, so any changes made in the idP would not be propagated until the user idles anyway.#1449 seems related, but I'm not actually experiencing that issue.
Additional context
I'm using Keycloak as idP.