Repository: coreos/dex
Pull request #556 (2016-08-16 19:37:19)

*: update go-oidc to remove dependency on capnslog
#543 relieved that we're suppressing the standard logger in dex due to some capnslog side effects. The actual code at fault was not tracked down, but removing the dependency entirely fixes the issue. Since capnslog is largely deprecated, this seems like a reasonable step to take.


Patch:
diff --git a/.travis.yml b/.travis.yml
index 6088b310..75e3cab6 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -23,7 +23,7 @@ install:
 
 script:
   - docker run -d -p 127.0.0.1:15432:5432 quay.io/coreos/postgres
-  - LDAPCONTAINER=`docker run -e LDAP_TLS_PROTOCOL_MIN=3.0 -e LDAP_TLS_CIPHER_SUITE=NORMAL -d -p 127.0.0.1:1389:389 -p 127.0.0.1:1636:636 -h tlstest.local osixia/openldap:1.1.4`
+  - LDAPCONTAINER=`docker run -e LDAP_TLS_PROTOCOL_MIN=3.0 -e LDAP_TLS_CIPHER_SUITE=NORMAL -d -p 127.0.0.1:1389:389 -p 127.0.0.1:1636:636 -h tlstest.local osixia/openldap`
   - ./build
   - ./test
   - docker cp ${LDAPCONTAINER}:container/service/:cfssl/assets/default-ca/default-ca.pem /tmp/openldap-ca.pem
diff --git a/Documentation/connectors-configuration.md b/Documentation/connectors-configuration.md
index 63842656..0970f308 100644
--- a/Documentation/connectors-configuration.md
+++ b/Documentation/connectors-configuration.md
@@ -48,7 +48,6 @@ This connector config lets users authenticate with other OIDC providers. In addi
 * clientID: a `string`. The OIDC client ID.
 * clientSecret: a `string`. The OIDC client secret.
 * trustedEmailProvider: a `boolean`. If true dex will trust the email address claims from this provider and not require that users verify their emails.
-* emailClaim: a `string`. The name of the claim to be treated as an email claim. If empty dex will use a `email` claim.
 
 In order to use the `oidc` connector you must register dex as an OIDC client; this mechanism is different from provider to provider. For Google, follow the instructions at their [developer site](https://developers.google.com/identity/protocols/OpenIDConnect?hl=en). Regardless of your provider, registering your client will also provide you with the client ID and secret.
 
diff --git a/Documentation/getting-started.md b/Documentation/getting-started.md
index 72f50806..59b2d667 100644
--- a/Documentation/getting-started.md
+++ b/Documentation/getting-started.md
@@ -20,7 +20,7 @@ In addition, if you wish to try out authenticating against Google's OIDC backend
 
 * Go to https://console.developers.google.com/project and select an existing project or create a new project.
 * Click on APIs and auth > Credentials, and select an OAuth 2 client ID from the Add credentials dropdown.
-* On the "Create Client ID" screen, choose "Web Application", provide a Name and enter `http://127.0.0.1:5556/dex/auth/google/callback` for your Authorised redirect URI.
+* On the "Create Client ID" screen, choose "Web Application", provide a Name and enter `http://127.0.0.1:5556/auth/google/callback` for your Authorised redirect URI.
 * The generated client ID and client secret will be needed later.
 
 # Create Database
@@ -55,13 +55,13 @@ The dex overlord and workers allow multiple key secrets (separated by commas) to
 
 # Generate an Admin API Secret
 
-The dex overlord has an API which is very powerful - you can create Admin users with it, so it needs to be protected somehow. This is accomplished by requiring that a secret is passed via the Authorization header of each request. This secret is 128 bytes base64 encoded, and should be sufficiently random so as to make guessing impractical:
+The dex overlord has a an API which is very powerful - you can create Admin users with it, so it needs to be protected somehow. This is accomplished by requiring that a secret is passed via the Authorization header of each request. This secret is 128 bytes base64 encoded, and should be sufficiently random so as to make guessing impractical:
 
 `DEX_OVERLORD_ADMIN_API_SECRET=$(dd if=/dev/random bs=1 count=128 2>/dev/null | base64 | tr -d '\n')`
 
 # Start the overlord
 
-The overlord is responsible for creating and rotating keys and some other administrative tasks. In addition, the overlord is responsible for creating the necessary database tables (and when you update, performing schema migrations), so it must be started before we do anything else. Debug logging is turned on so we can see more of what's going on. Start it up.
+The overlord is responsible for creating and rotating keys and some other adminsitrative tasks. In addition, the overlord is responsible for creating the necessary database tables (and when you update, performing schema migrations), so it must be started before we do anything else. Debug logging is turned on so we can see more of what's going on. Start it up.
 
 `./bin/dex-overlord --admin-api-secret=$DEX_OVERLORD_ADMIN_API_SECRET --db-url=$DEX_DB_URL --key-secrets=$DEX_KEY_SECRET --log-debug=true &`
 
@@ -142,7 +142,7 @@ DEX_APP_CLIENT_SECRET
 The included example app demonstrates registering and authenticating with dex. Start it up:
 
 ```
-./bin/example-app --client-id=$DEX_APP_CLIENT_ID --client-secret=$DEX_APP_CLIENT_SECRET --discovery=http://127.0.0.1:5556/dex &
+./bin/example-app --client-id=$DEX_APP_CLIENT_ID --client-secret=$DEX_APP_CLIENT_SECRET --discovery=http://127.0.0.1:5556 &
 ```
 
 # Authenticate with dex!
@@ -161,4 +161,4 @@ In a fully configured production environment an email provider will be set up so
 
 # Standup Dev Script
 
-A script which does almost everything in this guide exists at `contrib/standup-db.sh`. Read the comments inside before attempting to run it - it requires a little setup beforehand.
+A script which does almost everything in this guide exists at `contrib/standup-db.sh`. Read the comments inside before attemping to run it - it requires a little setup beforehand.
diff --git a/Documentation/tls-setup.md b/Documentation/tls-setup.md
index 29341364..04df64bc 100644
--- a/Documentation/tls-setup.md
+++ b/Documentation/tls-setup.md
@@ -46,7 +46,7 @@ When establishing connection to the server, we will need to provide the CA file
 ./bin/example-app \
     --trusted-ca-file=examples/tls-setup/certs/ca.pem \
     --client-id="XXX" \
-    --client-secret="c2VjcmV0ZQ==" \
+    --client-secret="secrete" \
     --redirect-url="http://127.0.0.1:5555/callback" \
     --discovery="https://127.0.0.1:5556" \
     --listen="http://127.0.0.1:5555"
diff --git a/connector/connector_oidc.go b/connector/connector_oidc.go
index 4aa4c33b..ee320c86 100644
--- a/connector/connector_oidc.go
+++ b/connector/connector_oidc.go
@@ -15,7 +15,6 @@ import (
 const (
 	OIDCConnectorType = "oidc"
 	httpPathCallback  = "/callback"
-	defaultEmailClaim = "email"
 )
 
 func init() {
@@ -28,7 +27,6 @@ type OIDCConnectorConfig struct {
 	ClientID             string `json:"clientID"`
 	ClientSecret         string `json:"clientSecret"`
 	TrustedEmailProvider bool   `json:"trustedEmailProvider"`
-	EmailClaim           string `json:"emailClaim"`
 }
 
 func (cfg *OIDCConnectorConfig) ConnectorID() string {
@@ -46,7 +44,6 @@ type OIDCConnector struct {
 	loginFunc            oidc.LoginFunc
 	client               *oidc.Client
 	trustedEmailProvider bool
-	emailClaim           string
 }
 
 func (cfg *OIDCConnectorConfig) Connector(ns url.URL, lf oidc.LoginFunc, tpls *template.Template) (Connector, error) {
@@ -72,7 +69,6 @@ func (cfg *OIDCConnectorConfig) Connector(ns url.URL, lf oidc.LoginFunc, tpls *t
 		loginFunc:            lf,
 		client:               cl,
 		trustedEmailProvider: cfg.TrustedEmailProvider,
-		emailClaim:           cfg.EmailClaim,
 	}
 	return idpc, nil
 }
@@ -148,30 +144,6 @@ func (c *OIDCConnector) handleCallbackFunc(lf oidc.LoginFunc, errorURL url.URL)
 			return
 		}
 
-		// Override the email claim by using the value of the specified claim.
-		// This is used for the provider (e.g., Azure AD) which returns
-		// the ID token that does not include a email claim.
-		if c.emailClaim != "" && c.emailClaim != defaultEmailClaim {
-			email, ok, err := claims.StringClaim(c.emailClaim)
-			if err != nil {
-				log.Errorf("Unable to get value of alternative email claim: %v", err)
-				q.Set("error", oauth2.ErrorUnsupportedResponseType)
-				q.Set("error_description", "unable to get value of alternative email claim")
-				redirectError(w, errorURL, q)
-				return
-			}
-
-			if !ok {
-				log.Errorf("Failed parsing alternative email claim from remote provider: %v", err)
-				q.Set("error", oauth2.ErrorUnsupportedResponseType)
-				q.Set("error_description", "failed parsing alternative email claim")
-				redirectError(w, errorURL, q)
-				return
-			}
-
-			claims.Add(defaultEmailClaim, email)
-		}
-
 		ident, err := oidc.IdentityFromClaims(claims)
 		if err != nil {
 			log.Errorf("Failed parsing claims from remote provider: %v", err)
diff --git a/db/refresh.go b/db/refresh.go
index 08735416..0baa655f 100644
--- a/db/refresh.go
+++ b/db/refresh.go
@@ -91,108 +91,47 @@ func NewRefreshTokenRepoWithGenerator(dbm *gorp.DbMap, gen refresh.RefreshTokenG
 }
 
 func (r *refreshTokenRepo) Create(userID, clientID, connectorID string, scopes []string) (string, error) {
-	return r.create(nil, userID, clientID, connectorID, scopes)
-}
-
-func (r *refreshTokenRepo) Verify(clientID, token string) (userID, connectorID string, scope scope.Scopes, err error) {
-	return r.verify(nil, clientID, token)
-}
-
-func (r *refreshTokenRepo) Revoke(userID, token string) error {
-	tx, err := r.begin()
-	if err != nil {
-		return err
-	}
-	defer tx.Rollback()
-	if err := r.revoke(tx, userID, token); err != nil {
-		return err
+	if userID == "" {
+		return "", refresh.ErrorInvalidUserID
 	}
-
-	return tx.Commit()
-}
-
-func (r *refreshTokenRepo) RenewRefreshToken(clientID, userID, oldToken string) (newRefreshToken string, err error) {
-	// Verify
-	userID, connectorID, scopes, err := r.verify(nil, clientID, oldToken)
-	if err != nil {
-		return "", err
+	if clientID == "" {
+		return "", refresh.ErrorInvalidClientID
 	}
 
-	// Revoke old refresh token
-	tx, err := r.begin()
+	// TODO(yifan): Check the number of tokens given to the client-user pair.
+	tokenPayload, err := r.tokenGenerator.Generate()
 	if err != nil {
 		return "", err
 	}
-	defer tx.Rollback()
-	if err := r.revoke(tx, userID, oldToken); err != nil {
-		return "", err
-	}
 
-	// Renew refresh token
-	newRefreshToken, err = r.create(tx, userID, clientID, connectorID, scopes)
+	payloadHash, err := bcrypt.GenerateFromPassword(tokenPayload, bcrypt.DefaultCost)
 	if err != nil {
 		return "", err
 	}
 
-	return newRefreshToken, tx.Commit()
-}
-
-func (r *refreshTokenRepo) RevokeTokensForClient(userID, clientID string) error {
-	q := fmt.Sprintf("DELETE FROM %s WHERE user_id = $1 AND client_id = $2", r.quote(refreshTokenTableName))
-	_, err := r.executor(nil).Exec(q, userID, clientID)
-	return err
-}
-
-func (r *refreshTokenRepo) ClientsWithRefreshTokens(userID string) ([]client.Client, error) {
-	q := `SELECT c.* FROM %s as c
-	INNER JOIN %s as r ON c.id = r.client_id WHERE r.user_id = $1;`
-	q = fmt.Sprintf(q, r.quote(clientTableName), r.quote(refreshTokenTableName))
-	var clients []clientModel
-	if _, err := r.executor(nil).Select(&clients, q, userID); err != nil {
-		return nil, err
-	}
-
-	c := make([]client.Client, len(clients))
-	for i, client := range clients {
-		ident, err := client.Client()
-		if err != nil {
-			return nil, err
-		}
-		c[i] = *ident
-		// Do not share the secret.
-		c[i].Credentials.Secret = ""
-	}
-
-	return c, nil
-}
-
-func (r *refreshTokenRepo) get(tx repo.Transaction, tokenID int64) (*refreshTokenModel, error) {
-	ex := r.executor(tx)
-	result, err := ex.Get(refreshTokenModel{}, tokenID)
-	if err != nil {
-		return nil, err
+	record := &refreshTokenModel{
+		PayloadHash: payloadHash,
+		UserID:      userID,
+		ClientID:    clientID,
+		ConnectorID: connectorID,
+		Scopes:      strings.Join(scopes, " "),
 	}
 
-	if result == nil {
-		return nil, refresh.ErrorInvalidToken
+	if err := r.executor(nil).Insert(record); err != nil {
+		return "", err
 	}
 
-	record, ok := result.(*refreshTokenModel)
-	if !ok {
-		log.Errorf("expected refreshTokenModel but found %v", reflect.TypeOf(result))
-		return nil, errors.New("unrecognized model")
-	}
-	return record, nil
+	return buildToken(record.ID, tokenPayload), nil
 }
 
-func (r *refreshTokenRepo) verify(tx repo.Transaction, clientID, token string) (userID, connectorID string, scope scope.Scopes, err error) {
+func (r *refreshTokenRepo) Verify(clientID, token string) (userID, connectorID string, scope scope.Scopes, err error) {
 	tokenID, tokenPayload, err := parseToken(token)
 
 	if err != nil {
 		return
 	}
 
-	record, err := r.get(tx, tokenID)
+	record, err := r.get(nil, tokenID)
 	if err != nil {
 		return
 	}
@@ -201,7 +140,6 @@ func (r *refreshTokenRepo) verify(tx repo.Transaction, clientID, token string) (
 		return "", "", nil, refresh.ErrorInvalidClientID
 	}
 
-	// Check if the hash of token received is the same stored in database
 	if err = checkTokenPayload(record.PayloadHash, tokenPayload); err != nil {
 		return
 	}
@@ -214,46 +152,17 @@ func (r *refreshTokenRepo) verify(tx repo.Transaction, clientID, token string) (
 	return record.UserID, record.ConnectorID, scopes, nil
 }
 
-func (r *refreshTokenRepo) create(tx repo.Transaction, userID, clientID, connectorID string, scopes []string) (string, error) {
-	if userID == "" {
-		return "", refresh.ErrorInvalidUserID
-	}
-	if clientID == "" {
-		return "", refresh.ErrorInvalidClientID
-	}
-
-	// TODO(yifan): Check the number of tokens given to the client-user pair.
-	tokenPayload, err := r.tokenGenerator.Generate()
-	if err != nil {
-		return "", err
-	}
-
-	payloadHash, err := bcrypt.GenerateFromPassword(tokenPayload, bcrypt.DefaultCost)
+func (r *refreshTokenRepo) Revoke(userID, token string) error {
+	tokenID, tokenPayload, err := parseToken(token)
 	if err != nil {
-		return "", err
-	}
-
-	record := &refreshTokenModel{
-		PayloadHash: payloadHash,
-		UserID:      userID,
-		ClientID:    clientID,
-		ConnectorID: connectorID,
-		Scopes:      strings.Join(scopes, " "),
-	}
-
-	if err := r.executor(tx).Insert(record); err != nil {
-		return "", err
+		return err
 	}
 
-	return buildToken(record.ID, tokenPayload), nil
-}
-
-func (r *refreshTokenRepo) revoke(tx repo.Transaction, userID, token string) error {
-	tokenID, tokenPayload, err := parseToken(token)
+	tx, err := r.begin()
 	if err != nil {
 		return err
 	}
-
+	defer tx.Rollback()
 	exec := r.executor(tx)
 	record, err := r.get(tx, tokenID)
 	if err != nil {
@@ -276,5 +185,53 @@ func (r *refreshTokenRepo) revoke(tx repo.Transaction, userID, token string) err
 		return refresh.ErrorInvalidToken
 	}
 
-	return nil
+	return tx.Commit()
+}
+
+func (r *refreshTokenRepo) RevokeTokensForClient(userID, clientID string) error {
+	q := fmt.Sprintf("DELETE FROM %s WHERE user_id = $1 AND client_id = $2", r.quote(refreshTokenTableName))
+	_, err := r.executor(nil).Exec(q, userID, clientID)
+	return err
+}
+
+func (r *refreshTokenRepo) ClientsWithRefreshTokens(userID string) ([]client.Client, error) {
+	q := `SELECT c.* FROM %s as c
+	INNER JOIN %s as r ON c.id = r.client_id WHERE r.user_id = $1;`
+	q = fmt.Sprintf(q, r.quote(clientTableName), r.quote(refreshTokenTableName))
+	var clients []clientModel
+	if _, err := r.executor(nil).Select(&clients, q, userID); err != nil {
+		return nil, err
+	}
+
+	c := make([]client.Client, len(clients))
+	for i, client := range clients {
+		ident, err := client.Client()
+		if err != nil {
+			return nil, err
+		}
+		c[i] = *ident
+		// Do not share the secret.
+		c[i].Credentials.Secret = ""
+	}
+
+	return c, nil
+}
+
+func (r *refreshTokenRepo) get(tx repo.Transaction, tokenID int64) (*refreshTokenModel, error) {
+	ex := r.executor(tx)
+	result, err := ex.Get(refreshTokenModel{}, tokenID)
+	if err != nil {
+		return nil, err
+	}
+
+	if result == nil {
+		return nil, refresh.ErrorInvalidToken
+	}
+
+	record, ok := result.(*refreshTokenModel)
+	if !ok {
+		log.Errorf("expected refreshTokenModel but found %v", reflect.TypeOf(result))
+		return nil, errors.New("unrecognized model")
+	}
+	return record, nil
 }
diff --git a/examples/README.md b/examples/README.md
index 9f325c89..947ec5b6 100644
--- a/examples/README.md
+++ b/examples/README.md
@@ -34,7 +34,7 @@ supplying the client information from `./static/fixtures/clients.json` into the
 ```console
 ./bin/example-app \
 	--client-id=example-app \
-	--client-secret=eZXhhbXBsZS1jbGktc2VjcmV0 \
+	--client-secret=example-app-secret \
 	--discovery=http://127.0.0.1:5556
 ```
 
@@ -54,6 +54,6 @@ The example CLI will start, connect to the Dex instance to gather discovery info
 ```console
 ./bin/example-cli \
 	--client-id example-cli \
-	--client-secret ZXhhbXBsZS1jbGktc2VjcmV0 \
+	--client-secret examplie-cli-secret \
 	--discovery=http://127.0.0.1:5556
 ```
diff --git a/glide.lock b/glide.lock
index c4f5fb61..818deb2a 100644
--- a/glide.lock
+++ b/glide.lock
@@ -1,10 +1,10 @@
-hash: 2e6ef5ae85fe17d9b695b37ba6875b438a617692cc1f6fefc682c4e405a4dcf1
-updated: 2016-06-28T10:36:39.146887182-07:00
+hash: 9e02d162b5001e9ba3028f5cac8b8a85f73be2e7546a4add488b446821e13da6
+updated: 2016-08-16T12:24:59.701803152-07:00
 imports:
 - name: github.com/andybalholm/cascadia
   version: 6122e68c2642b7b75c538a63b15168c6c80fb757
 - name: github.com/coreos/go-oidc
-  version: 5aa9381f6e998aa16cc96b4347d33dcc29792864
+  version: 1efe0e1303a62da553fcb6beb8bd2aa9250c0ca8
   subpackages:
   - http
   - jose
@@ -14,7 +14,6 @@ imports:
 - name: github.com/coreos/pkg
   version: fa94270d4bac0d8ae5dc6b71894e251aada93f74
   subpackages:
-  - capnslog
   - flagutil
   - health
   - httputil
diff --git a/glide.yaml b/glide.yaml
index a6646213..a8c37dd4 100644
--- a/glide.yaml
+++ b/glide.yaml
@@ -5,7 +5,7 @@ import:
 - package: github.com/andybalholm/cascadia
   version: 6122e68c2642b7b75c538a63b15168c6c80fb757
 - package: github.com/coreos/go-oidc
-  version: 5aa9381f6e998aa16cc96b4347d33dcc29792864
+  version: 1efe0e1303a62da553fcb6beb8bd2aa9250c0ca8
   subpackages:
   - http
   - jose
@@ -15,7 +15,6 @@ import:
 - package: github.com/coreos/pkg
   version: fa94270d4bac0d8ae5dc6b71894e251aada93f74
   subpackages:
-  - capnslog
   - flagutil
   - health
   - httputil
diff --git a/refresh/repo.go b/refresh/repo.go
index b2fdc054..23ccda85 100644
--- a/refresh/repo.go
+++ b/refresh/repo.go
@@ -54,9 +54,6 @@ type RefreshTokenRepo interface {
 	// Revoke deletes the refresh token if the token belongs to the given userID.
 	Revoke(userID, token string) error
 
-	// Revoke old refresh token and generates a new one
-	RenewRefreshToken(clientID, userID, oldToken string) (newRefreshToken string, err error)
-
 	// RevokeTokensForClient revokes all tokens issued for the userID for the provided client.
 	RevokeTokensForClient(userID, clientID string) error
 
diff --git a/server/http.go b/server/http.go
index 007a9d4e..b3a7cc86 100644
--- a/server/http.go
+++ b/server/http.go
@@ -520,7 +520,7 @@ func handleTokenFunc(srv OIDCServer) http.HandlerFunc {
 				writeTokenError(w, oauth2.NewError(oauth2.ErrorInvalidRequest), state)
 				return
 			}
-			jwt, refreshToken, err = srv.RefreshToken(creds, strings.Split(scopes, " "), token)
+			jwt, err = srv.RefreshToken(creds, strings.Split(scopes, " "), token)
 			if err != nil {
 				writeTokenError(w, err, state)
 				return
diff --git a/server/server.go b/server/server.go
index 2ca65b82..48ff8dc8 100644
--- a/server/server.go
+++ b/server/server.go
@@ -53,9 +53,9 @@ type OIDCServer interface {
 
 	ClientCredsToken(creds oidc.ClientCredentials) (*jose.JWT, error)
 
-	// RefreshToken takes a previously generated refresh token and returns a new ID token and new refresh token
+	// RefreshToken takes a previously generated refresh token and returns a new ID token
 	// if the token is valid.
-	RefreshToken(creds oidc.ClientCredentials, scopes scope.Scopes, token string) (*jose.JWT, string, error)
+	RefreshToken(creds oidc.ClientCredentials, scopes scope.Scopes, token string) (*jose.JWT, error)
 
 	KillSession(string) error
 
@@ -567,15 +567,15 @@ func (s *Server) CodeToken(creds oidc.ClientCredentials, sessionKey string) (*jo
 	return jwt, refreshToken, nil
 }
 
-func (s *Server) RefreshToken(creds oidc.ClientCredentials, scopes scope.Scopes, token string) (*jose.JWT, string, error) {
+func (s *Server) RefreshToken(creds oidc.ClientCredentials, scopes scope.Scopes, token string) (*jose.JWT, error) {
 	ok, err := s.ClientManager.Authenticate(creds)
 	if err != nil {
 		log.Errorf("Failed fetching client %s from repo: %v", creds.ID, err)
-		return nil, "", oauth2.NewError(oauth2.ErrorServerError)
+		return nil, oauth2.NewError(oauth2.ErrorServerError)
 	}
 	if !ok {
 		log.Errorf("Failed to Authenticate client %s", creds.ID)
-		return nil, "", oauth2.NewError(oauth2.ErrorInvalidClient)
+		return nil, oauth2.NewError(oauth2.ErrorInvalidClient)
 	}
 
 	userID, connectorID, rtScopes, err := s.RefreshTokenRepo.Verify(creds.ID, token)
@@ -583,18 +583,18 @@ func (s *Server) RefreshToken(creds oidc.ClientCredentials, scopes scope.Scopes,
 	case nil:
 		break
 	case refresh.ErrorInvalidToken:
-		return nil, "", oauth2.NewError(oauth2.ErrorInvalidRequest)
+		return nil, oauth2.NewError(oauth2.ErrorInvalidRequest)
 	case refresh.ErrorInvalidClientID:
-		return nil, "", oauth2.NewError(oauth2.ErrorInvalidClient)
+		return nil, oauth2.NewError(oauth2.ErrorInvalidClient)
 	default:
-		return nil, "", oauth2.NewError(oauth2.ErrorServerError)
+		return nil, oauth2.NewError(oauth2.ErrorServerError)
 	}
 
 	if len(scopes) == 0 {
 		scopes = rtScopes
 	} else {
 		if !rtScopes.Contains(scopes) {
-			return nil, "", oauth2.NewError(oauth2.ErrorInvalidRequest)
+			return nil, oauth2.NewError(oauth2.ErrorInvalidRequest)
 		}
 	}
 
@@ -603,7 +603,7 @@ func (s *Server) RefreshToken(creds oidc.ClientCredentials, scopes scope.Scopes,
 		// The error can be user.ErrorNotFound, but we are not deleting
 		// user at this moment, so this shouldn't happen.
 		log.Errorf("Failed to fetch user %q from repo: %v: ", userID, err)
-		return nil, "", oauth2.NewError(oauth2.ErrorServerError)
+		return nil, oauth2.NewError(oauth2.ErrorServerError)
 	}
 
 	var groups []string
@@ -611,19 +611,19 @@ func (s *Server) RefreshToken(creds oidc.ClientCredentials, scopes scope.Scopes,
 		conn, ok := s.connector(connectorID)
 		if !ok {
 			log.Errorf("refresh token contained invalid connector ID (%s)", connectorID)
-			return nil, "", oauth2.NewError(oauth2.ErrorServerError)
+			return nil, oauth2.NewError(oauth2.ErrorServerError)
 		}
 
 		grouper, ok := conn.(connector.GroupsConnector)
 		if !ok {
 			log.Errorf("refresh token requested groups for connector (%s) that doesn't support groups", connectorID)
-			return nil, "", oauth2.NewError(oauth2.ErrorServerError)
+			return nil, oauth2.NewError(oauth2.ErrorServerError)
 		}
 
 		remoteIdentities, err := s.UserRepo.GetRemoteIdentities(nil, userID)
 		if err != nil {
 			log.Errorf("failed to get remote identities: %v", err)
-			return nil, "", oauth2.NewError(oauth2.ErrorServerError)
+			return nil, oauth2.NewError(oauth2.ErrorServerError)
 		}
 		remoteIdentity, ok := func() (user.RemoteIdentity, bool) {
 			for _, ri := range remoteIdentities {
@@ -635,18 +635,18 @@ func (s *Server) RefreshToken(creds oidc.ClientCredentials, scopes scope.Scopes,
 		}()
 		if !ok {
 			log.Errorf("failed to get remote identity for connector %s", connectorID)
-			return nil, "", oauth2.NewError(oauth2.ErrorServerError)
+			return nil, oauth2.NewError(oauth2.ErrorServerError)
 		}
 		if groups, err = grouper.Groups(remoteIdentity.ID); err != nil {
 			log.Errorf("failed to get groups for refresh token: %v", connectorID)
-			return nil, "", oauth2.NewError(oauth2.ErrorServerError)
+			return nil, oauth2.NewError(oauth2.ErrorServerError)
 		}
 	}
 
 	signer, err := s.KeyManager.Signer()
 	if err != nil {
 		log.Errorf("Failed to refresh ID token: %v", err)
-		return nil, "", oauth2.NewError(oauth2.ErrorServerError)
+		return nil, oauth2.NewError(oauth2.ErrorServerError)
 	}
 
 	now := time.Now()
@@ -666,18 +666,12 @@ func (s *Server) RefreshToken(creds oidc.ClientCredentials, scopes scope.Scopes,
 	jwt, err := jose.NewSignedJWT(claims, signer)
 	if err != nil {
 		log.Errorf("Failed to generate ID token: %v", err)
-		return nil, "", oauth2.NewError(oauth2.ErrorServerError)
-	}
-
-	refreshToken, err := s.RefreshTokenRepo.RenewRefreshToken(creds.ID, userID, token)
-	if err != nil {
-		log.Errorf("Failed to generate new refresh token: %v", err)
-		return nil, "", oauth2.NewError(oauth2.ErrorServerError)
+		return nil, oauth2.NewError(oauth2.ErrorServerError)
 	}
 
 	log.Infof("New token sent: clientID=%s", creds.ID)
 
-	return jwt, refreshToken, nil
+	return jwt, nil
 }
 
 func (s *Server) CrossClientAuthAllowed(requestingClientID, authorizingClientID string) (bool, error) {
diff --git a/vendor/github.com/coreos/go-oidc/http/http.go b/vendor/github.com/coreos/go-oidc/http/http.go
index f0d051b5..c3f51215 100644
--- a/vendor/github.com/coreos/go-oidc/http/http.go
+++ b/vendor/github.com/coreos/go-oidc/http/http.go
@@ -4,18 +4,13 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"errors"
+	"log"
 	"net/http"
 	"net/url"
 	"path"
 	"strconv"
 	"strings"
 	"time"
-
-	"github.com/coreos/pkg/capnslog"
-)
-
-var (
-	log = capnslog.NewPackageLogger("github.com/coreos/go-oidc", "http")
 )
 
 func WriteError(w http.ResponseWriter, code int, msg string) {
@@ -26,7 +21,9 @@ func WriteError(w http.ResponseWriter, code int, msg string) {
 	}
 	b, err := json.Marshal(e)
 	if err != nil {
-		log.Errorf("Failed marshaling %#v to JSON: %v", e, err)
+		log.Printf("go-oidc: failed to marshal %#v: %v", e, err)
+		code = http.StatusInternalServerError
+		b = []byte(`{"error":"server_error"}`)
 	}
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(code)
diff --git a/vendor/github.com/coreos/go-oidc/http/middleware.go b/vendor/github.com/coreos/go-oidc/http/middleware.go
deleted file mode 100644
index 270b3bc0..00000000
--- a/vendor/github.com/coreos/go-oidc/http/middleware.go
+++ /dev/null
@@ -1,14 +0,0 @@
-package http
-
-import (
-	"net/http"
-)
-
-type LoggingMiddleware struct {
-	Next http.Handler
-}
-
-func (l *LoggingMiddleware) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	log.Infof("HTTP %s %v", r.Method, r.URL)
-	l.Next.ServeHTTP(w, r)
-}
diff --git a/vendor/github.com/coreos/go-oidc/key/rotate.go b/vendor/github.com/coreos/go-oidc/key/rotate.go
index 9c5508bc..bc6cdfb1 100644
--- a/vendor/github.com/coreos/go-oidc/key/rotate.go
+++ b/vendor/github.com/coreos/go-oidc/key/rotate.go
@@ -2,16 +2,14 @@ package key
 
 import (
 	"errors"
+	"log"
 	"time"
 
-	"github.com/coreos/pkg/capnslog"
 	ptime "github.com/coreos/pkg/timeutil"
 	"github.com/jonboulle/clockwork"
 )
 
 var (
-	log = capnslog.NewPackageLogger("github.com/coreos/go-oidc", "key")
-
 	ErrorPrivateKeysExpired = errors.New("private keys have expired")
 )
 
@@ -67,7 +65,6 @@ func (r *PrivateKeyRotator) privateKeySet() (*PrivateKeySet, error) {
 func (r *PrivateKeyRotator) nextRotation() (time.Duration, error) {
 	pks, err := r.privateKeySet()
 	if err == ErrorNoKeys {
-		log.Infof("No keys in private key set; must rotate immediately")
 		return 0, nil
 	}
 	if err != nil {
@@ -94,17 +91,15 @@ func (r *PrivateKeyRotator) Run() chan struct{} {
 	attempt := func() {
 		k, err := r.generateKey()
 		if err != nil {
-			log.Errorf("Failed generating signing key: %v", err)
+			log.Printf("go-oidc: failed generating signing key: %v", err)
 			return
 		}
 
 		exp := r.expiresAt()
 		if err := rotatePrivateKeys(r.repo, k, r.keep, exp); err != nil {
-			log.Errorf("Failed key rotation: %v", err)
+			log.Printf("go-oidc: key rotation failed: %v", err)
 			return
 		}
-
-		log.Infof("Rotated signing keys: id=%s expiresAt=%s", k.ID(), exp)
 	}
 
 	stop := make(chan struct{})
@@ -118,11 +113,10 @@ func (r *PrivateKeyRotator) Run() chan struct{} {
 					break
 				}
 				sleep = ptime.ExpBackoff(sleep, time.Minute)
-				log.Errorf("error getting nextRotation, retrying in %v: %v", sleep, err)
+				log.Printf("go-oidc: error getting nextRotation, retrying in %v: %v", sleep, err)
 				time.Sleep(sleep)
 			}
 
-			log.Infof("will rotate keys in %v", nextRotation)
 			select {
 			case <-r.clock.After(nextRotation):
 				attempt()
diff --git a/vendor/github.com/coreos/go-oidc/key/sync.go b/vendor/github.com/coreos/go-oidc/key/sync.go
index e8d5d03d..b887f7b5 100644
--- a/vendor/github.com/coreos/go-oidc/key/sync.go
+++ b/vendor/github.com/coreos/go-oidc/key/sync.go
@@ -2,6 +2,7 @@ package key
 
 import (
 	"errors"
+	"log"
 	"time"
 
 	"github.com/jonboulle/clockwork"
@@ -38,15 +39,14 @@ func (s *KeySetSyncer) Run() chan struct{} {
 					next = timeutil.ExpBackoff(next, time.Minute)
 				}
 				if exp == 0 {
-					log.Errorf("Synced to already expired key set, retrying in %v: %v", next, err)
+					log.Printf("Synced to already expired key set, retrying in %v: %v", next, err)
 
 				} else {
-					log.Errorf("Failed syncing key set, retrying in %v: %v", next, err)
+					log.Printf("Failed syncing key set, retrying in %v: %v", next, err)
 				}
 			} else {
 				failing = false
 				next = exp / 2
-				log.Infof("Synced key set, checking again in %v", next)
 			}
 
 			select {
diff --git a/vendor/github.com/coreos/go-oidc/oidc/provider.go b/vendor/github.com/coreos/go-oidc/oidc/provider.go
index dcae4c92..ca283844 100644
--- a/vendor/github.com/coreos/go-oidc/oidc/provider.go
+++ b/vendor/github.com/coreos/go-oidc/oidc/provider.go
@@ -4,13 +4,13 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"log"
 	"net/http"
 	"net/url"
 	"strings"
 	"sync"
 	"time"
 
-	"github.com/coreos/pkg/capnslog"
 	"github.com/coreos/pkg/timeutil"
 	"github.com/jonboulle/clockwork"
 
@@ -18,10 +18,6 @@ import (
 	"github.com/coreos/go-oidc/oauth2"
 )
 
-var (
-	log = capnslog.NewPackageLogger("github.com/coreos/go-oidc", "http")
-)
-
 const (
 	// Subject Identifier types defined by the OIDC spec. Specifies if the provider
 	// should provide the same sub claim value to all clients (public) or a unique
@@ -69,6 +65,8 @@ type ProviderConfig struct {
 	UserInfoEndpoint     *url.URL
 	KeysEndpoint         *url.URL // Required
 	RegistrationEndpoint *url.URL
+	EndSessionEndpoint   *url.URL
+	CheckSessionIFrame   *url.URL
 
 	// Servers MAY choose not to advertise some supported scope values even when this
 	// parameter is used, although those defined in OpenID Core SHOULD be listed, if supported.
@@ -170,6 +168,8 @@ type encodableProviderConfig struct {
 	UserInfoEndpoint     string `json:"userinfo_endpoint,omitempty"`
 	KeysEndpoint         string `json:"jwks_uri"`
 	RegistrationEndpoint string `json:"registration_endpoint,omitempty"`
+	EndSessionEndpoint   string `json:"end_session_endpoint,omitempty"`
+	CheckSessionIFrame   string `json:"check_session_iframe,omitempty"`
 
 	// Use 'omitempty' for all slices as per OIDC spec:
 	// "Claims that return multiple values are represented as JSON arrays.
@@ -219,6 +219,8 @@ func (cfg ProviderConfig) toEncodableStruct() encodableProviderConfig {
 		UserInfoEndpoint:                           uriToString(cfg.UserInfoEndpoint),
 		KeysEndpoint:                               uriToString(cfg.KeysEndpoint),
 		RegistrationEndpoint:                       uriToString(cfg.RegistrationEndpoint),
+		EndSessionEndpoint:                         uriToString(cfg.EndSessionEndpoint),
+		CheckSessionIFrame:                         uriToString(cfg.CheckSessionIFrame),
 		ScopesSupported:                            cfg.ScopesSupported,
 		ResponseTypesSupported:                     cfg.ResponseTypesSupported,
 		ResponseModesSupported:                     cfg.ResponseModesSupported,
@@ -260,6 +262,8 @@ func (e encodableProviderConfig) toStruct() (ProviderConfig, error) {
 		UserInfoEndpoint:                           p.parseURI(e.UserInfoEndpoint, "userinfo_endpoint"),
 		KeysEndpoint:                               p.parseURI(e.KeysEndpoint, "jwks_uri"),
 		RegistrationEndpoint:                       p.parseURI(e.RegistrationEndpoint, "registration_endpoint"),
+		EndSessionEndpoint:                         p.parseURI(e.EndSessionEndpoint, "end_session_endpoint"),
+		CheckSessionIFrame:                         p.parseURI(e.CheckSessionIFrame, "check_session_iframe"),
 		ScopesSupported:                            e.ScopesSupported,
 		ResponseTypesSupported:                     e.ResponseTypesSupported,
 		ResponseModesSupported:                     e.ResponseModesSupported,
@@ -364,6 +368,8 @@ func (p ProviderConfig) Valid() error {
 		{p.UserInfoEndpoint, "userinfo_endpoint", false},
 		{p.KeysEndpoint, "jwks_uri", true},
 		{p.RegistrationEndpoint, "registration_endpoint", false},
+		{p.EndSessionEndpoint, "end_session_endpoint", false},
+		{p.CheckSessionIFrame, "check_session_iframe", false},
 		{p.ServiceDocs, "service_documentation", false},
 		{p.Policy, "op_policy_uri", false},
 		{p.TermsOfService, "op_tos_uri", false},
@@ -537,8 +543,6 @@ func (s *ProviderConfigSyncer) sync() (time.Duration, error) {
 		s.initialSyncDone = true
 	}
 
-	log.Debugf("Updating provider config: config=%#v", cfg)
-
 	return nextSyncAfter(cfg.ExpiresAt, s.clock), nil
 }
 
@@ -561,10 +565,9 @@ func (n *pcsStepNext) step(fn pcsStepFunc) (next pcsStepper) {
 	ttl, err := fn()
 	if err == nil {
 		next = &pcsStepNext{aft: ttl}
-		log.Debugf("Synced provider config, next attempt in %v", next.after())
 	} else {
 		next = &pcsStepRetry{aft: time.Second}
-		log.Errorf("Provider config sync failed, retrying in %v: %v", next.after(), err)
+		log.Printf("go-oidc: provider config sync falied, retyring in %v: %v", next.after(), err)
 	}
 	return
 }
@@ -581,10 +584,9 @@ func (r *pcsStepRetry) step(fn pcsStepFunc) (next pcsStepper) {
 	ttl, err := fn()
 	if err == nil {
 		next = &pcsStepNext{aft: ttl}
-		log.Infof("Provider config sync no longer failing")
 	} else {
 		next = &pcsStepRetry{aft: timeutil.ExpBackoff(r.aft, time.Minute)}
-		log.Errorf("Provider config sync still failing, retrying in %v: %v", next.after(), err)
+		log.Printf("go-oidc: provider config sync falied, retyring in %v: %v", next.after(), err)
 	}
 	return
 }


Test patch:
diff --git a/integration/admin_api_test.go b/integration/admin_api_test.go
index 5ecb3aaa..26fd3b8d 100644
--- a/integration/admin_api_test.go
+++ b/integration/admin_api_test.go
@@ -337,7 +337,6 @@ func TestConnectors(t *testing.T) {
 						"clientID":             "foo",
 						"clientSecret":         "bar",
 						"trustedEmailProvider": true,
-						"emailClaim":           "",
 					},
 				},
 			},
@@ -354,7 +353,6 @@ func TestConnectors(t *testing.T) {
 						"clientID":             "foo",
 						"clientSecret":         "bar",
 						"trustedEmailProvider": true,
-						"emailClaim":           "",
 					},
 				},
 			},
diff --git a/server/server_test.go b/server/server_test.go
index 280bbd00..f724a260 100644
--- a/server/server_test.go
+++ b/server/server_test.go
@@ -107,10 +107,6 @@ func makeNewUserRepo() (user.UserRepo, error) {
 	return userRepo, nil
 }
 
-func getRefreshTokenEncoded(id, value string) string {
-	return fmt.Sprintf("%v/%s", id, base64.URLEncoding.EncodeToString([]byte(value)))
-}
-
 func TestServerProviderConfig(t *testing.T) {
 	srv := &Server{IssuerURL: url.URL{Scheme: "http", Host: "server.example.com"}}
 
@@ -616,29 +612,27 @@ func TestServerRefreshToken(t *testing.T) {
 	// NOTE(ericchiang): These tests assume that the database ID of the first
 	// refresh token will be "1".
 	tests := []struct {
-		token                string
-		expectedRefreshToken string
-		clientID             string // The client that associates with the token.
-		creds                oidc.ClientCredentials
-		signer               jose.Signer
-		createScopes         []string
-		refreshScopes        []string
-		expectedAud          []string
-		err                  error
+		token         string
+		clientID      string // The client that associates with the token.
+		creds         oidc.ClientCredentials
+		signer        jose.Signer
+		createScopes  []string
+		refreshScopes []string
+		expectedAud   []string
+		err           error
 	}{
 		// Everything is good.
 		{
-			token:                getRefreshTokenEncoded("1", "refresh-1"),
-			expectedRefreshToken: getRefreshTokenEncoded("1", "refresh-2"),
-			clientID:             testClientID,
-			creds:                testClientCredentials,
-			signer:               signerFixture,
-			createScopes:         []string{"openid", "profile"},
-			refreshScopes:        []string{"openid", "profile"},
+			token:         fmt.Sprintf("1/%s", base64.URLEncoding.EncodeToString([]byte("refresh-1"))),
+			clientID:      testClientID,
+			creds:         testClientCredentials,
+			signer:        signerFixture,
+			createScopes:  []string{"openid", "profile"},
+			refreshScopes: []string{"openid", "profile"},
 		},
 		// Asking for a scope not originally granted to you.
 		{
-			token:         getRefreshTokenEncoded("1", "refresh-1"),
+			token:         fmt.Sprintf("1/%s", base64.URLEncoding.EncodeToString([]byte("refresh-1"))),
 			clientID:      testClientID,
 			creds:         testClientCredentials,
 			signer:        signerFixture,
@@ -658,7 +652,7 @@ func TestServerRefreshToken(t *testing.T) {
 		},
 		// Invalid refresh token(invalid payload content).
 		{
-			token:         getRefreshTokenEncoded("1", "refresh-2"),
+			token:         fmt.Sprintf("1/%s", base64.URLEncoding.EncodeToString([]byte("refresh-2"))),
 			clientID:      testClientID,
 			creds:         testClientCredentials,
 			signer:        signerFixture,
@@ -668,7 +662,7 @@ func TestServerRefreshToken(t *testing.T) {
 		},
 		// Invalid refresh token(invalid ID content).
 		{
-			token:         getRefreshTokenEncoded("0", "refresh-1"),
+			token:         fmt.Sprintf("0/%s", base64.URLEncoding.EncodeToString([]byte("refresh-1"))),
 			clientID:      testClientID,
 			creds:         testClientCredentials,
 			signer:        signerFixture,
@@ -678,7 +672,7 @@ func TestServerRefreshToken(t *testing.T) {
 		},
 		// Invalid client(client is not associated with the token).
 		{
-			token:         getRefreshTokenEncoded("1", "refresh-1"),
+			token:         fmt.Sprintf("1/%s", base64.URLEncoding.EncodeToString([]byte("refresh-1"))),
 			clientID:      testClientID,
 			creds:         clientB.Credentials,
 			signer:        signerFixture,
@@ -688,7 +682,7 @@ func TestServerRefreshToken(t *testing.T) {
 		},
 		// Invalid client(no client ID).
 		{
-			token:         getRefreshTokenEncoded("1", "refresh-1"),
+			token:         fmt.Sprintf("1/%s", base64.URLEncoding.EncodeToString([]byte("refresh-1"))),
 			clientID:      testClientID,
 			creds:         oidc.ClientCredentials{ID: "", Secret: "aaa"},
 			signer:        signerFixture,
@@ -698,7 +692,7 @@ func TestServerRefreshToken(t *testing.T) {
 		},
 		// Invalid client(no such client).
 		{
-			token:         getRefreshTokenEncoded("1", "refresh-1"),
+			token:         fmt.Sprintf("1/%s", base64.URLEncoding.EncodeToString([]byte("refresh-1"))),
 			clientID:      testClientID,
 			creds:         oidc.ClientCredentials{ID: "AAA", Secret: "aaa"},
 			signer:        signerFixture,
@@ -708,7 +702,7 @@ func TestServerRefreshToken(t *testing.T) {
 		},
 		// Invalid client(no secrets).
 		{
-			token:         getRefreshTokenEncoded("1", "refresh-1"),
+			token:         fmt.Sprintf("1/%s", base64.URLEncoding.EncodeToString([]byte("refresh-1"))),
 			clientID:      testClientID,
 			creds:         oidc.ClientCredentials{ID: testClientID},
 			signer:        signerFixture,
@@ -718,7 +712,7 @@ func TestServerRefreshToken(t *testing.T) {
 		},
 		// Invalid client(invalid secret).
 		{
-			token:         getRefreshTokenEncoded("1", "refresh-1"),
+			token:         fmt.Sprintf("1/%s", base64.URLEncoding.EncodeToString([]byte("refresh-1"))),
 			clientID:      testClientID,
 			creds:         oidc.ClientCredentials{ID: "bad-id", Secret: "bad-secret"},
 			signer:        signerFixture,
@@ -728,7 +722,7 @@ func TestServerRefreshToken(t *testing.T) {
 		},
 		// Signing operation fails.
 		{
-			token:         getRefreshTokenEncoded("1", "refresh-1"),
+			token:         fmt.Sprintf("1/%s", base64.URLEncoding.EncodeToString([]byte("refresh-1"))),
 			clientID:      testClientID,
 			creds:         testClientCredentials,
 			signer:        &StaticSigner{sig: nil, err: errors.New("fail")},
@@ -738,9 +732,8 @@ func TestServerRefreshToken(t *testing.T) {
 		},
 		// Valid Cross-Client
 		{
-			token:                getRefreshTokenEncoded("1", "refresh-1"),
-			expectedRefreshToken: getRefreshTokenEncoded("1", "refresh-2"),
-			clientID:             "client_a",
+			token:    fmt.Sprintf("1/%s", base64.URLEncoding.EncodeToString([]byte("refresh-1"))),
+			clientID: "client_a",
 			creds: oidc.ClientCredentials{
 				ID: "client_a",
 				Secret: base64.URLEncoding.EncodeToString(
@@ -755,9 +748,8 @@ func TestServerRefreshToken(t *testing.T) {
 		// refresh request, which should result in the original stored scopes
 		// being used.
 		{
-			token:                getRefreshTokenEncoded("1", "refresh-1"),
-			expectedRefreshToken: getRefreshTokenEncoded("1", "refresh-2"),
-			clientID:             "client_a",
+			token:    fmt.Sprintf("1/%s", base64.URLEncoding.EncodeToString([]byte("refresh-1"))),
+			clientID: "client_a",
 			creds: oidc.ClientCredentials{
 				ID: "client_a",
 				Secret: base64.URLEncoding.EncodeToString(
@@ -771,9 +763,8 @@ func TestServerRefreshToken(t *testing.T) {
 		// Valid Cross-Client - asking for fewer scopes than originally used
 		// when creating the refresh token, which is ok.
 		{
-			token:                getRefreshTokenEncoded("1", "refresh-1"),
-			expectedRefreshToken: getRefreshTokenEncoded("1", "refresh-2"),
-			clientID:             "client_a",
+			token:    fmt.Sprintf("1/%s", base64.URLEncoding.EncodeToString([]byte("refresh-1"))),
+			clientID: "client_a",
 			creds: oidc.ClientCredentials{
 				ID: "client_a",
 				Secret: base64.URLEncoding.EncodeToString(
@@ -786,9 +777,8 @@ func TestServerRefreshToken(t *testing.T) {
 		},
 		// Valid Cross-Client - asking for multiple clients in the audience.
 		{
-			token:                getRefreshTokenEncoded("1", "refresh-1"),
-			expectedRefreshToken: getRefreshTokenEncoded("1", "refresh-2"),
-			clientID:             "client_a",
+			token:    fmt.Sprintf("1/%s", base64.URLEncoding.EncodeToString([]byte("refresh-1"))),
+			clientID: "client_a",
 			creds: oidc.ClientCredentials{
 				ID: "client_a",
 				Secret: base64.URLEncoding.EncodeToString(
@@ -802,7 +792,7 @@ func TestServerRefreshToken(t *testing.T) {
 		// Invalid Cross-Client - didn't orignally request cross-client when
 		// refresh token was created.
 		{
-			token:    getRefreshTokenEncoded("1", "refresh-1"),
+			token:    fmt.Sprintf("1/%s", base64.URLEncoding.EncodeToString([]byte("refresh-1"))),
 			clientID: "client_a",
 			creds: oidc.ClientCredentials{
 				ID: "client_a",
@@ -835,7 +825,7 @@ func TestServerRefreshToken(t *testing.T) {
 			t.Fatalf("Unexpected error: %v", err)
 		}
 
-		jwt, refreshToken, err := f.srv.RefreshToken(tt.creds, tt.refreshScopes, tt.token)
+		jwt, err := f.srv.RefreshToken(tt.creds, tt.refreshScopes, tt.token)
 		if !reflect.DeepEqual(err, tt.err) {
 			t.Errorf("Case %d: expect: %v, got: %v", i, tt.err, err)
 		}
@@ -871,9 +861,5 @@ func TestServerRefreshToken(t *testing.T) {
 					expectedAud, claims["aud"])
 			}
 		}
-
-		if diff := pretty.Compare(refreshToken, tt.expectedRefreshToken); diff != "" {
-			t.Errorf("Case %d: want=%v, got=%v", i, tt.expectedRefreshToken, refreshToken)
-		}
 	}
 }
diff --git a/vendor/github.com/coreos/go-oidc/key/rotate_test.go b/vendor/github.com/coreos/go-oidc/key/rotate_test.go
index 394a84f0..b66a4b86 100644
--- a/vendor/github.com/coreos/go-oidc/key/rotate_test.go
+++ b/vendor/github.com/coreos/go-oidc/key/rotate_test.go
@@ -92,7 +92,7 @@ func TestRotate(t *testing.T) {
 		if tt.start != nil {
 			err := repo.Set(tt.start)
 			if err != nil {
-				log.Fatalf("case %d: unexpected error: %v", i, err)
+				t.Fatalf("case %d: unexpected error: %v", i, err)
 			}
 		}
 
@@ -242,7 +242,7 @@ func TestNextRotation(t *testing.T) {
 			}
 			err := kRepo.Set(pks)
 			if err != nil {
-				log.Fatalf("case %d: unexpected error: %v", i, err)
+				t.Fatalf("case %d: unexpected error: %v", i, err)
 			}
 
 		}
@@ -300,7 +300,7 @@ func TestHealthy(t *testing.T) {
 			}
 			err := kRepo.Set(pks)
 			if err != nil {
-				log.Fatalf("case %d: unexpected error: %v", i, err)
+				t.Fatalf("case %d: unexpected error: %v", i, err)
 			}
 
 		}