Add Auth to Any App with OAuth2 Proxy

Developer Blog Comments
13

For anyone who cares to have refresh tokens working there are a few things that are needed beyond this article (We spent way too much time figuring this out so thought we should share).

  1. You need to add OAUTH2_PROXY_SCOPE: "openid email profile offline_access" to your environment. offline_access is not included by default in Oauth2Proxy and is needed to get a refresh_token. Ref: OAuth 2.0 Scopes (okta.com)
  2. Make sure to set OAUTH2_PROXY_COOKIE_EXPIRE shorter than the refresh token lifetime. The refresh token lifetime was hard to find and the default is supposed to be 90days but was 60min on my Okta dev server. Both Access and Refresh Tokens having the same lifetime is problematic unless you use a rotating refresh token in the next step. Refs: ODIC & OAuth 2.0 OKTA token lifetime, Okta Refresh Token Lifetime Does Not Match
  3. Turn on Refresh Token Grant (make rotating if desired) (Make Refresh access tokens and rotate refresh tokens | Okta Developer
  4. On a secure server Cookies may need OAUTH2_PROXY_COOKIE_SAMESITE: none and OAUTH2_PROXY_COOKIE_SECURE: true but this has not been confirmed.

Notes:

  • Oauth2Proxy does not add the set-Cookie header unless it is needed so it will not be present in the first call but a call after the OAUTH2_PROXY_COOKIE_REFRESH time should include it.
  • To Debug what is returned from the Auth request you can directly access /oauth2/auth by commenting out internal and inspecting its headers.
  • In the Oauth2Proxy Logs you will get refresh-token: true included in a long message if it is being received.
  • In OKTA Reports>System Log will help you check if the Refresh token is being sent.

I think that covers it. If I think of anything else I will update. Good Luck

1 Like