How to handle token refresh with docker compose setup

[inyono]

We were using hydra with "memory" storage to develop and test our hydra integration with our local docker compose setup.

Unfortunately, this doesn't work with a token refresh setup at the moment, see also

hydra/oauth2/oauth2_refresh_token_test.go

Lines 79 to 80 in 24f91ab

	// todo check why sqlite fails with "no such table: hydra_oauth2_refresh \n sqlite create"
	// should be fine though as nobody should use sqlite in production

Are there workarounds for that?

• Is there a workaround to get token refresh working with sqlite?
• If not: is there an easy way to handle automigrate with a docker-compose setup? When using postgres for storage, the workflow is a little bit clunky, since hydra crashes without the migrations, so the workflow is something like:
  • docker-compose up (to start postgres. Hydra will crash because of missing migrations)
  • docker-compose run hydra migrate sql --yes --read-from-env (to actually run the migrations)
  • docker-compose up (to restart hydra)

[aeneasr]

Is there a workaround to get token refresh working with sqlite?

Refresh tokens work fine with SQLite. The linked issue is a stress test to ensure transaction atomicity and isolation. What error (logs + HTTP + response) are you seeing exactly?

is there an easy way to handle automigrate with a docker-compose setup

Unfortunately, PostgreSQL does not support online migrations out of the box as far as I know, so stopping the service, applying migrations, and restarting it is currently the suggested practice.

An alternative for docker-compose is to add an init job to your docker compose yaml which does the migration so you don't have to run 3 commands!

[aeneasr]

Could you please share your software version and configuration? SQLite does need migrations. Depending on what mode you use they should be applied automatically though

[inyono]

Sure thing: https://gist.github.com/inyono/7e741e5601c9e9ca479485416a62c980.

We didn't apply any migrations so far (and w/o refresh tokens, things worked out smoothly). If we get automigrations to work (if they don't yet), that would be awesome!

[aeneasr]

That's very strange, DSN=memory should trigger auto-migrations. We're using this DSN for all functional tests and also integration tests that of course cover refresh tokens as well.

E2E tests use an on-disk SQLite and run a dedicated migrations command, these also test refresh token behavior. The same applies to our OIDC conformity test suite, which also tests refresh tokens.

So I think this is related to your set up or execution order. Could you please share a reproducible repository with shell commands (e.g. hydra clients create, curl ...) that reproduces this issue?

[inyono]

Yep, will do. Might take some time to unwrap everything. I'll let you know when I have a repro. Thanks for the help so far!

[vinckr]

Hey @inyono,
Just checking in if you had time to look more into it.
I will mark this as answered for now, but feel free to come back to the discussion any time!