How to automatically refresh token in apisix plugin Openid-connect

[SKDragon18]

Hello everyone, i want know how to set plugin routes to refresh token automatically, client dont need to refresh token to authorization server. Any help? This is my setting:

"openid-connect": {
      "accept_none_alg": false,
      "accept_unsupported_alg": true,
      "access_token_expires_leeway": 0,
      "access_token_in_authorization_header": false,
      "bearer_only": true,
      "client_id": "apisix",
      "client_jwt_assertion_expires_in": 60,
      "client_secret": "UDrN+4q9hETmW6YJQrIssdfTudn9+PC", 
      "discovery": "http://host.docker.internal:8080/realms/apisix_test_realm/.well-known/openid-configuration",
      "force_reauthorize": false,
      "iat_slack": 120,
      "introspection_endpoint_auth_method": "client_secret_basic",
      "introspection_interval": 0,
      "jwk_expires_in": 86400,
      "jwt_verification_cache_ignore": false,
      "logout_path": "/logout",
      "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBfdsfdsJm37Xu9dWa6QniwLO+45u4tesgtlzCizpWCb41FD2dKVpcRQHKW\n2QIDAQAB\n-----END PUBLIC KEY-----", 
      "realm": "apisix_test_realm",
      "renew_access_token_on_expiry": true,
      "revoke_tokens_on_logout": false,
      "scope": "openid",
      "set_access_token_header": true,
      "set_id_token_header": true,
      "set_refresh_token_header": true,
      "set_userinfo_header": true,
      "ssl_verify": false,
      "timeout": 3,
      "token_endpoint_auth_method": "client_secret_basic",
      "token_signing_alg_values_expected": "RS256",
      "unauth_action": "auth",
      "use_nonce": false,
      "use_pkce": false
    }

[dosubot[bot]]

To automatically refresh tokens in the Openid-connect plugin for APISIX without requiring the client to contact the authorization server, you have already set the renew_access_token_on_expiry option to true. This configuration will attempt to silently renew the access token when it expires, which is what you are looking for.

Additionally, ensure that the set_refresh_token_header is set to true, as you have done, to include the refresh token in the X-Refresh-Token header for downstream services if needed ^[1].

Your current configuration seems to be set up correctly for automatic token renewal. If you encounter any issues, double-check the connectivity and configuration of your authorization server, as well as any logs that might provide more insight into the token renewal process.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[SKDragon18]

@dosu. Thank you for support, I don't know why it was not working even though I had set it correctly, did it ask X-Represh-Token, I'm quite sure my Refresh token is still available while Access Token has expired. This is the curl I used to test:

curl --location --request GET 'http://127.0.0.1:9080/api/dgraph/targets/all?page=1&size=15' \
--header 'X-Refresh-Token: eyJhbGciOiJIUzUxMiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJhYzljYWNmNi03ZmY4LTQ3YWYtOGY2Yi0xYTY2ZTdmMmE4NGMifQ.BhY3IifQ.9B00oMq1nU5j-rmL1gTFBxz9UpO1PrGl1O_-7EYywZzlPY33dQVNvt5A0IeIv19Xbvb3d3sz1xnZ_i1a4V7ZWg' \
--header 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJmYXFILXE0a3Bpd185ZnZNLWR3SG9rMXdCOU8zM1FvRWo4eVE2TUVzRmxvIn0.eyJleHIBt06yE93SBf0dQsfer_TFogbp1dm6eZ-I3eh-Rb-f8XqrmJNd2H_yaDno-6zSSdL69f-XBMbtW3avnT4DkQfFsi5rMhTmYMbGdnMoIs6EWQWA'

Log in server, seem it throw exp access token:

`2025/03/05 04:48:50 [error] 53#53: *390762 [lua] openid-connect.lua:533: phase_func(): OIDC introspection failed: jwt signature verification failed: 'exp' claim expired at Wed, 05 Mar 2025 04:37:11 GMT, client: 172.19.0.1, server: _, request: "GET /api/dgraph/targets/all?page=1&size=15 HTTP/1.1", host: "127.0.0.1:9080"
2025/03/05 04:48:50 [warn] 53#53: *390762 [lua] plugin.lua:1174: run_plugin(): openid-connect exits with http status code 401, client: 172.19.0.1, server: _, request: "GET /api/dgraph/targets/all?page=1&size=15 HTTP/1.1", host: "127.0.0.1:9080"
172.19.0.1 - - [05/Mar/2025:04:48:50 +0000] 127.0.0.1:9080 "GET /api/dgraph/targets/all?page=1&size=15 HTTP/1.1" 401 251 0.000 "-" "Apidog/1.0.0 (https://apidog.com)" - - - "http://127.0.0.1:9080"`