Oauth2 filter: refresh token support (#24684)

* Using a refresh token for updating the access token if that is provided by identity provider server

Signed-off-by: alexcei88 <alexcei88@yandex.ru>

* Add additional statistic counters to oauth2 filter

Signed-off-by: alexcei88 <alexcei88@yandex.ru>

* Increment oauth_success counter  in case getting access token by refresh token

Signed-off-by: alexcei88 <alexcei88@yandex.ru>

* More tests for oauth2 filter

Signed-off-by: alexcei88 <alexcei88@yandex.ru>

* Merge branch 'main' into oauth2_refresh_token_support

Signed-off-by: alexcei88 <alexcei88@yandex.ru>

* Removed unused function bearerPrefix. Added a test to coverage of setting refresh and id tokens from identity provider

Signed-off-by: alexcei88 <alexcei88@yandex.ru>

* Removed unused function bearerPrefix. Added a test to coverage of setting refresh and id tokens from identity provider

Signed-off-by: alexcei88 <alexcei88@yandex.ru>

* authorization header passing after updating access token using by refresh token

Signed-off-by: alexcei88 <alexcei88@yandex.ru>

* Add tests and remove some useless tests

Signed-off-by: alexcei88 <alexcei88@yandex.ru>

* update changelogs and docs

Signed-off-by: alexcei88 <alexcei88@yandex.ru>

* edit after review

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* Update docs/root/configuration/http/http_filters/oauth2_filter.rst

Co-authored-by: Snow Pettersen <aickck@gmail.com>
Signed-off-by: Alexcei <lex9.darovskoi@gmail.com>

* Update docs/root/configuration/http/http_filters/oauth2_filter.rst

Co-authored-by: Snow Pettersen <aickck@gmail.com>
Signed-off-by: Alexcei <lex9.darovskoi@gmail.com>

* Update docs/root/configuration/http/http_filters/oauth2_filter.rst

Co-authored-by: Snow Pettersen <aickck@gmail.com>
Signed-off-by: Alexcei <lex9.darovskoi@gmail.com>

* Update source/extensions/filters/http/oauth2/filter.cc

Co-authored-by: Snow Pettersen <aickck@gmail.com>
Signed-off-by: Alexcei <lex9.darovskoi@gmail.com>

* Edit after review. Cosmetic changes without changing of functionality

Signed-off-by: Alexcei <lex9.darovskoi@gmail.com>
Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* Fix tests build

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* Fix build tests

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* Changing after review

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* Fix oauth2 proto file

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* Fix oauth2 proto file

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* add integration test covered refresh token flow

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* Fix oauth2 test after merging

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* Edit after review

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* small refactoring after review

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* naming of functions

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* one more naming of functions

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* Fix formatting

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* Fix formatting

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* minor changes

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* fix variable name

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* fix build

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* Fix oauth2 tests

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* Fix formatting

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* Update docs/root/configuration/http/http_filters/oauth2_filter.rst

Co-authored-by: Derek Argueta <darguetap@gmail.com>
Signed-off-by: Alexcei <lex9.darovskoi@gmail.com>

* Update docs/root/configuration/http/http_filters/oauth2_filter.rst

Co-authored-by: Derek Argueta <darguetap@gmail.com>
Signed-off-by: Alexcei <lex9.darovskoi@gmail.com>

* Update docs/root/configuration/http/http_filters/oauth2_filter.rst

Co-authored-by: Derek Argueta <darguetap@gmail.com>
Signed-off-by: Alexcei <lex9.darovskoi@gmail.com>

* Fix formatting

Signed-off-by: Alexcei <lex9.darovskoi@gmail.com>
Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* Changed type of use_refresh_token to BoolValue

Signed-off-by: Alexcei <lex9.darovskoi@gmail.com>
Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* Fix formatting

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* added the end . after comment for use_refresh_token variable

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* Fix formatting

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

* Fixed formatting error in oauth.proto file

Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>

---------

Signed-off-by: alexcei88 <alexcei88@yandex.ru>
Signed-off-by: alexcei88 <lex9.darovskoi@gmail.com>
Signed-off-by: Alexcei <lex9.darovskoi@gmail.com>
Co-authored-by: alexcei88 <alexcei88@yandex.ru>
Co-authored-by: Snow Pettersen <aickck@gmail.com>
Co-authored-by: Derek Argueta <darguetap@gmail.com>

Mirrored from https://github.com/envoyproxy/envoy @ b31401c94476bc52743f25021c50de8490abe63b

envoy/extensions/filters/http/oauth2/v3/oauth.proto

@@ -7,6 +7,8 @@ import "envoy/config/route/v3/route_components.proto";
 import "envoy/extensions/transport_sockets/tls/v3/secret.proto";
 import "envoy/type/matcher/v3/path.proto";
 
+import "google/protobuf/wrappers.proto";
+
 import "udpa/annotations/status.proto";
 import "validate/validate.proto";
 
@@ -71,7 +73,7 @@ message OAuth2Credentials {
 
 // OAuth config
 //
-// [#next-free-field: 12]
+// [#next-free-field: 13]
 message OAuth2Config {
   enum AuthType {
     // The ``client_id`` and ``client_secret`` will be sent in the URL encoded request body.
@@ -123,6 +125,11 @@ message OAuth2Config {
   // Defines how ``client_id`` and ``client_secret`` are sent in OAuth client to OAuth server requests.
   // RFC https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1
   AuthType auth_type = 11 [(validate.rules).enum = {defined_only: true}];
+
+  // If set to true, allows automatic access token refresh using the associated refresh token (see
+  // `RFC 6749 section 6 <https://datatracker.ietf.org/doc/html/rfc6749#section-6>`_), provided that the OAuth server supports that.
+  // Default value is false.
+  google.protobuf.BoolValue use_refresh_token = 12;
 }
 
 // Filter config.