#1540
Issues/hoophq/hoop/#1540

[Bug]: Session expires every 1 hour despite Azure SSO + Conditional Access configured for 8-hour MFA

OpenRSSsureshopened 4mo ago

Bug Description

Authentication: Azure SSO Conditional Access: configured (MFA validation interval set to 8 hours)

Description: I'm facing an issue where the session expires every 1 hour, even though our Azure Conditional Access policy only requires MFA re-validation every 8 hours. I'd like to extend the session timeout from 1 hour to 8 hours so it aligns with our MFA policy.

Question: How can I extend the session timeout from 1 hour to 8 hours? Is this configurable in Hoop, and if so, where?

Error message: Error: access token is expired, try logging in again

Steps to Reproduce

Na

Expected Behavior

Session should remain valid for 8 hours, matching the Conditional Access MFA interval.

Actual Behavior

Session expires after 1 hour, requiring repeated logins.

Version

1.87.3

Browser(s)

Chrome

Operating System

macOs, Windows

Screenshots

Na

Additional Context

NA

Relevant Log Output

Na

Code of Conduct

  • I agree to follow this project's Code of Conduct

Activity

4
RSSsuresh4mo ago

CLI does not store refresh_token in ~/.hoop/config.toml and causing 1.5hr session expiry despite offline_access scope

  • IDP: Azure AD OIDC
  • IDP_CUSTOM_SCOPES includes offline_access
  • offline_access is Granted in Azure API Permissions
  • ~/.hoop/config.toml has no refresh_token field
  • Sessions expire every ~1.5hrs requiring manual re-login
  • Expected: refresh_token stored and used to maintain 8hr session

@sandromello, please give the solution for this.?

RSSsuresh4mo ago

@sandromello @racerxdl @aaronrenner there is any update about this, please help me to fix the session time out issue.

RSSsuresh3mo ago

Following up on #1540 — this is still blocking us, as sessions expire every ~1.5hrs even with offline_access granted in Azure and included in IDP_CUSTOM_SCOPES. The core issue seems to be that ~/.hoop/config.toml never gets a refresh_token field written to it, so the CLI has nothing to refresh with and forces re-login well before the 8-hour Conditional Access MFA window we've configured. Could someone confirm:

Is refresh_token persistence to config.toml currently implemented for Azure AD OIDC, or is this a known gap? If it's a gap, is there a workaround (e.g., a config flag or session TTL override) we could apply in the meantime on v1.87.3?

qwerty1q2w1mo ago

+1