From d15c1d56d306e047e7856f4f9bd313331166aabb Mon Sep 17 00:00:00 2001 From: Dean Sheather Date: Wed, 11 Jun 2025 05:29:58 +0000 Subject: [PATCH 1/3] chore: update IdP docs with Google quirks --- docs/admin/users/idp-sync.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/admin/users/idp-sync.md b/docs/admin/users/idp-sync.md index 123a5944c0e08..c648161a9b2e7 100644 --- a/docs/admin/users/idp-sync.md +++ b/docs/admin/users/idp-sync.md @@ -595,3 +595,13 @@ user is granted the necessary permissions to obtain refresh tokens. By combining the `{"access_type":"offline"}` parameter in the OIDC Auth URL with the `offline_access` scope, you can achieve the desired behavior of obtaining refresh tokens for offline access to the user's resources. + +### Google + +If you're using Google directly, you will likely want to set `prompt=consent` on +your auth URL to ensure you get refresh tokens. Without this, users will be +logged out of Coder after 1 hour. + +``` +CODER_OIDC_AUTH_URL_PARAMS={"access_type": "offline", "prompt": "consent"} +``` From c9933ae06e331aeaca05db5fa40813037f79cc28 Mon Sep 17 00:00:00 2001 From: Dean Sheather Date: Wed, 11 Jun 2025 05:59:26 +0000 Subject: [PATCH 2/3] redo --- docs/admin/users/idp-sync.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/admin/users/idp-sync.md b/docs/admin/users/idp-sync.md index c648161a9b2e7..457b7d2e68026 100644 --- a/docs/admin/users/idp-sync.md +++ b/docs/admin/users/idp-sync.md @@ -598,10 +598,12 @@ refresh tokens for offline access to the user's resources. ### Google -If you're using Google directly, you will likely want to set `prompt=consent` on -your auth URL to ensure you get refresh tokens. Without this, users will be -logged out of Coder after 1 hour. +To ensure Coder receives a refresh token when users authenticate with Google +directly, set the `prompt` to `consent` in the auth URL parameters. Without +this, users will be logged out after 1 hour. + +In your Coder configuration: ``` -CODER_OIDC_AUTH_URL_PARAMS={"access_type": "offline", "prompt": "consent"} +CODER_OIDC_AUTH_URL_PARAMS='{"access_type": "offline", "prompt": "consent"}' ``` From 873d80417c442babf41a4e830609553ecb2d54ed Mon Sep 17 00:00:00 2001 From: Dean Sheather Date: Wed, 11 Jun 2025 06:00:06 +0000 Subject: [PATCH 3/3] shell --- docs/admin/users/idp-sync.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/users/idp-sync.md b/docs/admin/users/idp-sync.md index 457b7d2e68026..47ee36bad65ac 100644 --- a/docs/admin/users/idp-sync.md +++ b/docs/admin/users/idp-sync.md @@ -604,6 +604,6 @@ this, users will be logged out after 1 hour. In your Coder configuration: -``` +```shell CODER_OIDC_AUTH_URL_PARAMS='{"access_type": "offline", "prompt": "consent"}' ```