feat(oauth2): revalidate access tokens

[danielkelemen]

related to #4585

[danielkelemen]

❌ The user remains logged in after the token is expired. When I use this scope for okta:

Some details to this:
Our AuthorizeTokenFilter uses the OAuth2AuthorizedClientManager, that tries to re-authorize the client using different oauth2 grants (auth code, refresh token etc.). When none of these succeed, it just returns the existing client from the context: ref, even if it contains an already expired access token.
In AuthorizeTokenFilter we also need to handle this use-case.

Why isn't the refresh working?
Okta doesn't support the refresh grant by default, only if the offline_access scope is defined (docs).

Solution:
After the authorize re-check token expiry and clear context if it's still expired.

[yanavasileva]

👍 I have a comment for the clock.

Tested with Okta after log out+5 min:

2024-09-17T17:11:27.830+02:00 DEBUG 24580 --- [nio-8080-exec-7] o.c.b.s.b.s.s.o.i.AuthorizeTokenFilter   : Authorize successful, access token expiry: 2024-09-17T15:11:42.154988400Z
2024-09-17T17:11:27.831+02:00 DEBUG 24580 --- [nio-8080-exec-7] s.b.s.s.o.i.OAuth2AuthenticationProvider : Authenticated user 'peter'
2024-09-17T17:11:27.835+02:00 DEBUG 24580 --- [nio-8080-exec-7] o.c.b.s.b.s.s.o.i.OAuth2IdentityProvider : Using OAuth2IdentityProvider
2024-09-17T17:11:27.835+02:00 DEBUG 24580 --- [nio-8080-exec-7] o.c.b.s.b.s.s.o.i.OAuth2IdentityProvider : Using OAuth2IdentityProvider
2024-09-17T17:11:27.836+02:00 DEBUG 24580 --- [nio-8080-exec-7] o.c.b.s.b.s.s.o.i.OAuth2IdentityProvider : Using OAuth2IdentityProvider
2024-09-17T17:11:49.080+02:00  WARN 24580 --- [nio-8080-exec-5] o.c.b.s.b.s.s.o.i.AuthorizeTokenFilter   : Authorize failed: could not re-authorize expired access token

[yanavasileva]

👍 Looks good. I re-tested okta with clear user sessions, seems fine to me. I didn't test cognito.

2024-09-19T08:49:47.941+02:00 DEBUG 29164 --- [nio-8080-exec-7] o.c.b.s.b.s.s.o.i.AuthorizeTokenFilter   : Authorize successful, access token expiry: 2024-09-19T06:54:47.511099300Z
2024-09-19T08:49:47.943+02:00 DEBUG 29164 --- [nio-8080-exec-4] s.b.s.s.o.i.OAuth2AuthenticationProvider : Authenticated user 'peter'
2024-09-19T08:49:47.943+02:00 DEBUG 29164 --- [nio-8080-exec-7] s.b.s.s.o.i.OAuth2AuthenticationProvider : Authenticated user 'peter'
2024-09-19T08:55:41.275+02:00  WARN 29164 --- [nio-8080-exec-4] o.c.b.s.b.s.s.o.i.AuthorizeTokenFilter   : Authorize failed: [invalid_grant] The refresh token is invalid or expired.

[yanavasileva]

Distro-ee is failing, but it's seems flakiness or not up-to-date branch.

[danielkelemen]

Distro-ee is failing, but it's seems flakiness or not up-to-date branch.

Yes, something is off with the package.json, probably not up to date as I didn't change anything there.