# Feature SI-214 - Do not require offline_access for authentication using OIDC tokens

Project: Stream Integration Basics
Status: specified
URL: https://community.openproject.org/work_packages/SI-214

## Planning

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Target versions | Product Backlog |
| Votes |  |
| List |  |
| Roadmap |  |
| Relevance |  |

## OPEN POINTS / FEEDBACK

_No work packages_

## Features and Chunks

_No work packages_

## Bugs and other work packages

_No work packages_

## Technical Details

| Attribute | Value |
| --- | --- |
| Module | Authentication / OpenID Connect (OIDC), Modules and project features / File storages |
| Feature Flag |  |
| Requires doc change | No |
| Enterprise plan |  |

## Details

| Attribute | Value |
| --- | --- |
| Pull preview |  |
| Mockups |  |
| Accessibility | No |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers | OP Dev Titan Team |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Estimates and progress

| Attribute | Value |
| --- | --- |
| PD (min) |  |
| PD (max) |  |
| Work |  |
| Labor costs |  |

## Description

**As** an administrator  
**I want to** allow configuring an integration without requiring the use of the offline\_access scope,  
**so that** the security in my setup is not at risk due to long-duration access tokens  
**and so that** users only need to authenticate once at the SSO provider, when using OpenProject together with other applications.

**Acceptance criteria**

  - It's possible to configure an storage integration authenticating through a common OIDC IDP, without configuring the offline\_access scope in the OIDC provider
    
      - ... without loosing access to the storage after some time

**Technical notes**

  - This requires that OpenProject keeps the SSO session at the IDP fresh & alive, i.e. by refreshing expired access tokens