Commit 2a9ed6d6 authored by José Manuel Domínguez's avatar José Manuel Domínguez
Browse files

Renew access tokens from PSA using valid refresh tokens 

Method `PSAAuthnz.refresh()` from psa_authnz.py holds its promise to refresh tokens only if they reached their half lifetime. However, that does not exclude expired tokens. Add an extra comparison to exclude expired refresh tokens.
parent 8bb7cc72

lib/galaxy/authnz/psa_authnz.py

+5 −1
Original line number Diff line number Diff line
@@ -179,7 +179,11 @@ class PSAAuthnz(IdentityProvider): 
        else:

            log.debug("No `expires` or `expires_in` key found in token extra data, cannot refresh")

            return False

        if int(user_authnz_token.extra_data["auth_time"]) + int(expires) / 2 <= int(time.time()):

        if (

            int(user_authnz_token.extra_data["auth_time"]) + int(expires) / 2

            <= int(time.time())

            < int(user_authnz_token.extra_data["auth_time"]) + int(expires)

        ):

            on_the_fly_config(trans.sa_session)

            if self.config["provider"] == "azure":

                self.refresh_azure(user_authnz_token)