App fails initial login with "invalid refresh token" when offline_access scope is omitted from WebFinger

[scndr]

Describe the bug
When configuring OpenCloud to use an external OIDC Identity Provider (such as Authelia) and removing the offline_access scope from both the IDP client setup and OpenCloud's WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES variable, it is impossible to perform the initial login on the Android app.

Immediately after completing the authentication on the Identity Provider, the login flow fails and the app displays the error "invalid refresh token".

To Reproduce
Configure an external OIDC Provider (e.g., Authelia) without the offline_access scope enabled for the Android client.

Override the WebFinger environment variable in OpenCloud to exclude offline_access:

WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES=openid profile email
Open the OpenCloud Android app, clear data/cache if previously configured, and attempt to add the account/server.

Complete the login flow on the external IdP.

Notice the error "invalid refresh token" right after authorization, preventing account creation.

Expected behavior
The app should handle OIDC authentication gracefully even if the offline_access scope is omitted and no Refresh Token is issued by the Provider, falling back to standard access token management instead of failing during the initial token exchange.

Context / Motivation
We are trying to remove offline_access because having offline_access / refresh_token flow triggers Authelia's explicit user consent screen, which degrades the UX. Removing offline_access is a standard approach to avoid consent prompts in some IdP setups, but the app currently enforces a refresh token check upon login.

[guruz]

Which app version is this?

Do you have a client or server side log to see which prompt= value the client sends when trying to auth or re-auth?

Are you trying to remove offline_access on purpose for normal usage or to get things working at all in your setup?

If you don't have refresh tokens (offline_access), what is your access token lifetime?

Authelia's explicit user consent screen

Is there no way to configure this on Authelia config to never show it?

[scndr]

the version is "1.2.5", and the prompt value is "login"

I removed the offline_access scope for my standard usage workflow. As expected, the logs confirm that the offline_access scope isn't in the request, and the OIDC provider successfully returns the access token anche complete the flow.

However, the mobile app fails to complete the login process and throws an "invalid refresh token" error.

It seems the app strictly expects a refresh token to be present in the OIDC response, even when offline_access is omitted and refresh tokens are not enabled/requested.

And the webapp the same config (no offline_access and same idp authelia) the flow works.

[guruz]

Is there no way to configure this on Authelia config to never show it?

Is this it authelia/authelia#4080 ? I have no idea about Authelia.

[scndr]

Thanks for looking into this!

Yes, I set consent_mode: 'implicit' in Authelia, but it still prompts for consent because of how Authelia handles refresh tokens: "The Authorization Code Flow will require explicit consent if a Refresh Token will be granted to the relying party" (see Authelia docs and this GitHub discussion).

Since removing offline_access works fine on the OpenCloud Web App, it looks like the Android app specifically assumes a refresh token will always be returned, causing it to fail when one isn't provided.

[scndr]

I think the issue is caused by this validation:
require(params.refreshToken.isNotEmpty()) { "Invalid refresh token" }
on file https://github.com/opencloud-eu/android/blob/main/opencloudDomain/src/main/java/eu/opencloud/android/domain/authentication/usecases/LoginOAuthAsyncUseCase.kt
This fails when offline_access is disabled, as the authorization server will not issue a refresh token in that scenario.