CODEWITHSUNDEEP
oauthjwtopenid-connectoauth2-proxyisam
Jonathan Rioux
Jonathan Rioux

Reputation: 1096

JWT with no claims after refreshing it

I'm using oauth2-proxy as a reverse proxy with IBM ISAM as the identity provider (IdP).

When doing the initial token request, (after requesting the /authorization endpoint), the JWT I receive contains all the claims I requested in the scope. That's perfect.

But now when I do a token refresh using the refresh_token on the /token endpoint, the JWT I receive contains only the basic info with no claims.

What am I doing wrong?

Can it be a limitation of IBM ISAM?

I need those claims to be in the JWT, because istio uses the "groups" claim to do authorization on requests. So after the JWT is refreshed, the user gets an access denied because the "groups" claim becomes empty in the JWT.

I troubleshooted this using Postman, there is a feature to debug an oauth2 flow.

Upvotes: 0

Views: 19

Answers (0)

Related Questions