fix: set refresh token in the RetrieveIdentityIntentResponse (#11613)

# Which Problems Are Solved

This PR adds support for storing and retrieving refresh tokens from
external identity providers during the IDP intent flow.

# How the Problems Are Solved

* Updated `idp.proto` (v2 and v2beta): added an optional `refresh_token`
field to `IDPOAuthAccessInformation`, which, in turn, is used in
`RetrieveIdentityProviderIntentResponse`
* Added the `IDPRefreshToken` field to the IDP intent `SucceededEvent`
struct, and updated the corresponding constructor to set the refresh
token
* Added the `IDPRefreshToken` field to `IDPIntentWriteModel`, and
updated `reduceOAuthSucceededEvent` to populate refresh token from
events
* Updated `tokensForSucceededIDPIntent` function to extract and encrypt
the refresh token from IDP session, if set
* Updated `idpOAuthTokensToPb` function to decrypt refresh token before
returning to clients
* Updated unit and integration tests

# Additional Changes
Updated the link to the JWT IDP docs linked in the Console

# Additional Context
- Closes https://github.com/zitadel/zitadel/issues/11047
This commit is contained in:
Gayathri Vijayan
2026-02-19 06:06:30 +00:00
committed by GitHub
parent a5a5b65931
commit 6ad1ef859b
13 changed files with 224 additions and 77 deletions
+5
View File
@@ -742,6 +742,7 @@ func TestCommands_updateSession(t *testing.T) {
"idpUserName",
"userID2",
nil,
nil,
"",
time.Now().Add(time.Hour),
),
@@ -823,6 +824,7 @@ func TestCommands_updateSession(t *testing.T) {
"idpUsername",
"userID",
nil,
nil,
"",
time.Now().Add(time.Hour),
),
@@ -878,6 +880,7 @@ func TestCommands_updateSession(t *testing.T) {
"idpUsername",
"userID",
nil,
nil,
"",
time.Now().Add(-time.Hour),
),
@@ -928,6 +931,7 @@ func TestCommands_updateSession(t *testing.T) {
"idpUsername",
"userID",
nil,
nil,
"",
time.Now().Add(time.Hour),
),
@@ -1005,6 +1009,7 @@ func TestCommands_updateSession(t *testing.T) {
"idpUsername",
"",
nil,
nil,
"",
time.Now().Add(time.Hour),
),