Repository: dexidp/dex
Pull request #3941 (2025-01-23 03:41:33)

Passing context storage
#### Overview

Added a context parameter for remaining storage operations (Get, Update, List, Delete, GarbageCollection).

#### What this PR does / why we need it
Closes https://github.com/dexidp/dex/issues/2132

#### Special notes for your reviewer
None


Patch:
diff --git a/.github/workflows/analysis-scorecard.yaml b/.github/workflows/analysis-scorecard.yaml
index f2f7252e..01d7e9b9 100644
--- a/.github/workflows/analysis-scorecard.yaml
+++ b/.github/workflows/analysis-scorecard.yaml
@@ -35,13 +35,13 @@ jobs:
           publish_results: true
 
       - name: Upload results as artifact
-        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         with:
           name: OpenSSF Scorecard results
           path: results.sarif
           retention-days: 5
 
       - name: Upload results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+        uses: github/codeql-action/upload-sarif@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/artifacts.yaml b/.github/workflows/artifacts.yaml
index 4b6a8ab7..71a2fea8 100644
--- a/.github/workflows/artifacts.yaml
+++ b/.github/workflows/artifacts.yaml
@@ -60,7 +60,7 @@ jobs:
         uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
 
       - name: Set up Syft
-        uses: anchore/sbom-action/download-syft@df80a981bc6edbc4e220a492d3cbe9f5547a6e75 # v0.17.9
+        uses: anchore/sbom-action/download-syft@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0
 
       - name: Install cosign
         uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
@@ -117,7 +117,7 @@ jobs:
 
       - name: Build and push image
         id: build
-        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
+        uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
         with:
           context: .
           platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x
@@ -177,14 +177,14 @@ jobs:
 
       # TODO: uncomment when the action is working for non ghcr.io pushes. GH Issue: https://github.com/actions/attest-build-provenance/issues/80
       # - name: Generate build provenance attestation
-      #   uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0
+      #   uses: actions/attest-build-provenance@520d128f165991a6c774bcb264f323e3d70747f4 # v2.2.0
       #   with:
       #     subject-name: dexidp/dex
       #     subject-digest: ${{ steps.build.outputs.digest }}
       #     push-to-registry: true
 
       - name: Generate build provenance attestation
-        uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0
+        uses: actions/attest-build-provenance@520d128f165991a6c774bcb264f323e3d70747f4 # v2.2.0
         with:
           subject-name: ghcr.io/dexidp/dex
           subject-digest: ${{ steps.build.outputs.digest }}
@@ -225,7 +225,7 @@ jobs:
         run: sudo chmod 0644 ./cache/db/trivy.db
 
       - name: Upload Trivy scan results as artifact
-        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         with:
           name: "[${{ github.job }}] Trivy scan results"
           path: trivy-results.sarif
@@ -233,6 +233,6 @@ jobs:
           overwrite: true
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+        uses: github/codeql-action/upload-sarif@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
         with:
           sarif_file: trivy-results.sarif
diff --git a/.github/workflows/checks.yaml b/.github/workflows/checks.yaml
index df94c8f0..98f6f664 100644
--- a/.github/workflows/checks.yaml
+++ b/.github/workflows/checks.yaml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Check minimum labels
-        uses: mheap/github-action-required-labels@d25134c992b943fb6ad00c25ea00eb5988c0a9dd # v5.4.2
+        uses: mheap/github-action-required-labels@388fd6af37b34cdfe5a23b37060e763217e58b03 # v5.5
         with:
           mode: minimum
           count: 1
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c6426521..dbc35bc3 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -69,7 +69,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Set up Go
-        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
         with:
           go-version: "1.23"
 
@@ -140,7 +140,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Set up Go
-        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
         with:
           go-version: "1.23"
 
diff --git a/.github/workflows/trivydb-cache.yaml b/.github/workflows/trivydb-cache.yaml
index 47f05d47..605071e1 100644
--- a/.github/workflows/trivydb-cache.yaml
+++ b/.github/workflows/trivydb-cache.yaml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Setup oras
-        uses: oras-project/setup-oras@9c92598691bfef1424de2f8fae81941568f5889c # v1.2.1
+        uses: oras-project/setup-oras@5c0b487ce3fe0ce3ab0d034e63669e426e294e4d # v1.2.2
 
       - name: Get current date
         id: date
diff --git a/connector/authproxy/authproxy.go b/connector/authproxy/authproxy.go
index 61353382..2419d3b7 100644
--- a/connector/authproxy/authproxy.go
+++ b/connector/authproxy/authproxy.go
@@ -19,11 +19,12 @@ import (
 // Headers retrieved to fetch user's email and group can be configured
 // with userHeader and groupHeader.
 type Config struct {
-	UserIDHeader string   `json:"userIDHeader"`
-	UserHeader   string   `json:"userHeader"`
-	EmailHeader  string   `json:"emailHeader"`
-	GroupHeader  string   `json:"groupHeader"`
-	Groups       []string `json:"staticGroups"`
+	UserIDHeader   string   `json:"userIDHeader"`
+	UserHeader     string   `json:"userHeader"`
+	UserNameHeader string   `json:"userNameHeader"`
+	EmailHeader    string   `json:"emailHeader"`
+	GroupHeader    string   `json:"groupHeader"`
+	Groups         []string `json:"staticGroups"`
 }
 
 // Open returns an authentication strategy which requires no user interaction.
@@ -36,6 +37,10 @@ func (c *Config) Open(id string, logger *slog.Logger) (connector.Connector, erro
 	if userHeader == "" {
 		userHeader = "X-Remote-User"
 	}
+	userNameHeader := c.UserNameHeader
+	if userNameHeader == "" {
+		userNameHeader = "X-Remote-User-Name"
+	}
 	emailHeader := c.EmailHeader
 	if emailHeader == "" {
 		emailHeader = "X-Remote-User-Email"
@@ -46,26 +51,28 @@ func (c *Config) Open(id string, logger *slog.Logger) (connector.Connector, erro
 	}
 
 	return &callback{
-		userIDHeader: userIDHeader,
-		userHeader:   userHeader,
-		emailHeader:  emailHeader,
-		groupHeader:  groupHeader,
-		groups:       c.Groups,
-		logger:       logger.With(slog.Group("connector", "type", "authproxy", "id", id)),
-		pathSuffix:   "/" + id,
+		userIDHeader:   userIDHeader,
+		userHeader:     userHeader,
+		userNameHeader: userNameHeader,
+		emailHeader:    emailHeader,
+		groupHeader:    groupHeader,
+		groups:         c.Groups,
+		logger:         logger.With(slog.Group("connector", "type", "authproxy", "id", id)),
+		pathSuffix:     "/" + id,
 	}, nil
 }
 
 // Callback is a connector which returns an identity with the HTTP header
 // X-Remote-User as verified email.
 type callback struct {
-	userIDHeader string
-	userHeader   string
-	emailHeader  string
-	groupHeader  string
-	groups       []string
-	logger       *slog.Logger
-	pathSuffix   string
+	userIDHeader   string
+	userNameHeader string
+	userHeader     string
+	emailHeader    string
+	groupHeader    string
+	groups         []string
+	logger         *slog.Logger
+	pathSuffix     string
 }
 
 // LoginURL returns the URL to redirect the user to login with.
@@ -87,6 +94,10 @@ func (m *callback) HandleCallback(s connector.Scopes, r *http.Request) (connecto
 	if remoteUser == "" {
 		return connector.Identity{}, fmt.Errorf("required HTTP header %s is not set", m.userHeader)
 	}
+	remoteUserName := r.Header.Get(m.userNameHeader)
+	if remoteUserName == "" {
+		remoteUserName = remoteUser
+	}
 	remoteUserID := r.Header.Get(m.userIDHeader)
 	if remoteUserID == "" {
 		remoteUserID = remoteUser
@@ -107,7 +118,7 @@ func (m *callback) HandleCallback(s connector.Scopes, r *http.Request) (connecto
 	return connector.Identity{
 		UserID:            remoteUserID,
 		Username:          remoteUser,
-		PreferredUsername: remoteUser,
+		PreferredUsername: remoteUserName,
 		Email:             remoteUserEmail,
 		EmailVerified:     true,
 		Groups:            groups,
diff --git a/examples/go.mod b/examples/go.mod
index 889e2ebf..508ce846 100644
--- a/examples/go.mod
+++ b/examples/go.mod
@@ -7,7 +7,7 @@ require (
 	github.com/dexidp/dex/api/v2 v2.2.0
 	github.com/spf13/cobra v1.8.1
 	golang.org/x/oauth2 v0.25.0
-	google.golang.org/grpc v1.69.4
+	google.golang.org/grpc v1.70.0
 )
 
 require (
@@ -18,6 +18,6 @@ require (
 	golang.org/x/net v0.33.0 // indirect
 	golang.org/x/sys v0.28.0 // indirect
 	golang.org/x/text v0.21.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241015192408-796eee8c2d53 // indirect
-	google.golang.org/protobuf v1.35.1 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20241202173237-19429a94021a // indirect
+	google.golang.org/protobuf v1.35.2 // indirect
 )
diff --git a/examples/go.sum b/examples/go.sum
index afdd2c1c..0edb67ab 100644
--- a/examples/go.sum
+++ b/examples/go.sum
@@ -28,16 +28,16 @@ github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
 github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-go.opentelemetry.io/otel v1.31.0 h1:NsJcKPIW0D0H3NgzPDHmo0WW6SptzPdqg/L1zsIm2hY=
-go.opentelemetry.io/otel v1.31.0/go.mod h1:O0C14Yl9FgkjqcCZAsE053C13OaddMYr/hz6clDkEJE=
-go.opentelemetry.io/otel/metric v1.31.0 h1:FSErL0ATQAmYHUIzSezZibnyVlft1ybhy4ozRPcF2fE=
-go.opentelemetry.io/otel/metric v1.31.0/go.mod h1:C3dEloVbLuYoX41KpmAhOqNriGbA+qqH6PQ5E5mUfnY=
-go.opentelemetry.io/otel/sdk v1.31.0 h1:xLY3abVHYZ5HSfOg3l2E5LUj2Cwva5Y7yGxnSW9H5Gk=
-go.opentelemetry.io/otel/sdk v1.31.0/go.mod h1:TfRbMdhvxIIr/B2N2LQW2S5v9m3gOQ/08KsbbO5BPT0=
-go.opentelemetry.io/otel/sdk/metric v1.31.0 h1:i9hxxLJF/9kkvfHppyLL55aW7iIJz4JjxTeYusH7zMc=
-go.opentelemetry.io/otel/sdk/metric v1.31.0/go.mod h1:CRInTMVvNhUKgSAMbKyTMxqOBC0zgyxzW55lZzX43Y8=
-go.opentelemetry.io/otel/trace v1.31.0 h1:ffjsj1aRouKewfr85U2aGagJ46+MvodynlQ1HYdmJys=
-go.opentelemetry.io/otel/trace v1.31.0/go.mod h1:TXZkRk7SM2ZQLtR6eoAWQFIHPvzQ06FJAsO1tJg480A=
+go.opentelemetry.io/otel v1.32.0 h1:WnBN+Xjcteh0zdk01SVqV55d/m62NJLJdIyb4y/WO5U=
+go.opentelemetry.io/otel v1.32.0/go.mod h1:00DCVSB0RQcnzlwyTfqtxSm+DRr9hpYrHjNGiBHVQIg=
+go.opentelemetry.io/otel/metric v1.32.0 h1:xV2umtmNcThh2/a/aCP+h64Xx5wsj8qqnkYZktzNa0M=
+go.opentelemetry.io/otel/metric v1.32.0/go.mod h1:jH7CIbbK6SH2V2wE16W05BHCtIDzauciCRLoc/SyMv8=
+go.opentelemetry.io/otel/sdk v1.32.0 h1:RNxepc9vK59A8XsgZQouW8ue8Gkb4jpWtJm9ge5lEG4=
+go.opentelemetry.io/otel/sdk v1.32.0/go.mod h1:LqgegDBjKMmb2GC6/PrTnteJG39I8/vJCAP9LlJXEjU=
+go.opentelemetry.io/otel/sdk/metric v1.32.0 h1:rZvFnvmvawYb0alrYkjraqJq0Z4ZUJAiyYCU9snn1CU=
+go.opentelemetry.io/otel/sdk/metric v1.32.0/go.mod h1:PWeZlq0zt9YkYAp3gjKZ0eicRYvOh1Gd+X99x6GHpCQ=
+go.opentelemetry.io/otel/trace v1.32.0 h1:WIC9mYrXf8TmY/EXuULKc8hR17vE+Hjv2cssQDe03fM=
+go.opentelemetry.io/otel/trace v1.32.0/go.mod h1:+i4rkvCraA+tG6AzwloGaCtkx53Fa+L+V8e9a7YvhT8=
 golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
@@ -48,12 +48,12 @@ golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241015192408-796eee8c2d53 h1:X58yt85/IXCx0Y3ZwN6sEIKZzQtDEYaBWrDvErdXrRE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241015192408-796eee8c2d53/go.mod h1:GX3210XPVPUjJbTUbvwI8f2IpZDMZuPJWDzDuebbviI=
-google.golang.org/grpc v1.69.4 h1:MF5TftSMkd8GLw/m0KM6V8CMOCY6NZ1NQDPGFgbTt4A=
-google.golang.org/grpc v1.69.4/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
-google.golang.org/protobuf v1.35.1 h1:m3LfL6/Ca+fqnjnlqQXNpFPABW1UD7mjh8KO2mKFytA=
-google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241202173237-19429a94021a h1:hgh8P4EuoxpsuKMXX/To36nOFD7vixReXgn8lPGnt+o=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241202173237-19429a94021a/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/grpc v1.70.0 h1:pWFv03aZoHzlRKHWicjsZytKAiYCtNS0dHbXnIdq7jQ=
+google.golang.org/grpc v1.70.0/go.mod h1:ofIJqVKDXx/JiXrwr2IG4/zwdH9txy3IlF40RmcJSQw=
+google.golang.org/protobuf v1.35.2 h1:8Ar7bF+apOIoThw1EdZl0p1oWvMqTHmpA2fRTyZO8io=
+google.golang.org/protobuf v1.35.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/go.mod b/go.mod
index 393bc6e9..594c79fb 100644
--- a/go.mod
+++ b/go.mod
@@ -8,13 +8,13 @@ require (
 	github.com/AppsFlyer/go-sundheit v0.6.0
 	github.com/Masterminds/semver v1.5.0
 	github.com/Masterminds/sprig/v3 v3.3.0
-	github.com/beevik/etree v1.4.1
-	github.com/coreos/go-oidc/v3 v3.11.0
+	github.com/beevik/etree v1.5.0
+	github.com/coreos/go-oidc/v3 v3.12.0
 	github.com/dexidp/dex/api/v2 v2.1.0
 	github.com/fsnotify/fsnotify v1.8.0
 	github.com/ghodss/yaml v1.0.0
 	github.com/go-jose/go-jose/v4 v4.0.4
-	github.com/go-ldap/ldap/v3 v3.4.8
+	github.com/go-ldap/ldap/v3 v3.4.10
 	github.com/go-sql-driver/mysql v1.8.1
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/handlers v1.5.2
@@ -29,8 +29,8 @@ require (
 	github.com/prometheus/client_golang v1.20.5
 	github.com/russellhaering/goxmldsig v1.4.0
 	github.com/spf13/cobra v1.8.1
-	github.com/stretchr/testify v1.9.0
-	go.etcd.io/etcd/client/pkg/v3 v3.5.17
+	github.com/stretchr/testify v1.10.0
+	go.etcd.io/etcd/client/pkg/v3 v3.5.18
 	go.etcd.io/etcd/client/v3 v3.5.17
 	golang.org/x/crypto v0.32.0
 	golang.org/x/exp v0.0.0-20221004215720-b9f4876ce741
@@ -38,7 +38,7 @@ require (
 	golang.org/x/oauth2 v0.25.0
 	google.golang.org/api v0.217.0
 	google.golang.org/grpc v1.69.4
-	google.golang.org/protobuf v1.36.2
+	google.golang.org/protobuf v1.36.4
 )
 
 require (
@@ -58,7 +58,7 @@ require (
 	github.com/coreos/go-systemd/v22 v22.3.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/go-asn1-ber/asn1-ber v1.5.5 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.7 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/inflect v0.19.0 // indirect
diff --git a/go.sum b/go.sum
index ed2214b4..9b42deb6 100644
--- a/go.sum
+++ b/go.sum
@@ -33,14 +33,14 @@ github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1L
 github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw=
 github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
 github.com/beevik/etree v1.1.0/go.mod h1:r8Aw8JqVegEf0w2fDnATrX9VpkMcyFeM0FhwO62wh+A=
-github.com/beevik/etree v1.4.1 h1:PmQJDDYahBGNKDcpdX8uPy1xRCwoCGVUiW669MEirVI=
-github.com/beevik/etree v1.4.1/go.mod h1:gPNJNaBGVZ9AwsidazFZyygnd+0pAU38N4D+WemwKNs=
+github.com/beevik/etree v1.5.0 h1:iaQZFSDS+3kYZiGoc9uKeOkUY3nYMXOKLl6KIJxiJWs=
+github.com/beevik/etree v1.5.0/go.mod h1:gPNJNaBGVZ9AwsidazFZyygnd+0pAU38N4D+WemwKNs=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/coreos/go-oidc/v3 v3.11.0 h1:Ia3MxdwpSw702YW0xgfmP1GVCMA9aEFWu12XUZ3/OtI=
-github.com/coreos/go-oidc/v3 v3.11.0/go.mod h1:gE3LgjOgFoHi9a4ce4/tJczr0Ai2/BoDhf0r5lltWI0=
+github.com/coreos/go-oidc/v3 v3.12.0 h1:sJk+8G2qq94rDI6ehZ71Bol3oUHy63qNYmkiSjrc/Jo=
+github.com/coreos/go-oidc/v3 v3.12.0/go.mod h1:gE3LgjOgFoHi9a4ce4/tJczr0Ai2/BoDhf0r5lltWI0=
 github.com/coreos/go-semver v0.3.0 h1:wkHLiw0WNATZnSG7epLsujiMCgPAc9xhjJ4tgnAxmfM=
 github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-systemd/v22 v22.3.2 h1:D9/bQk5vlXQFZ6Kwuu6zaiXJ9oTPe68++AzAJc1DzSI=
@@ -60,12 +60,12 @@ github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/
 github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/go-asn1-ber/asn1-ber v1.5.5 h1:MNHlNMBDgEKD4TcKr36vQN68BA00aDfjIt3/bD50WnA=
-github.com/go-asn1-ber/asn1-ber v1.5.5/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/go-asn1-ber/asn1-ber v1.5.7 h1:DTX+lbVTWaTw1hQ+PbZPlnDZPEIs0SS/GCZAl535dDk=
+github.com/go-asn1-ber/asn1-ber v1.5.7/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
 github.com/go-jose/go-jose/v4 v4.0.4 h1:VsjPI33J0SB9vQM6PLmNjoHqMQNGPiZ0rHL7Ni7Q6/E=
 github.com/go-jose/go-jose/v4 v4.0.4/go.mod h1:NKb5HO1EZccyMpiZNbdUw/14tiXNyUJh188dfnMCAfc=
-github.com/go-ldap/ldap/v3 v3.4.8 h1:loKJyspcRezt2Q3ZRMq2p/0v8iOurlmeXDPw6fikSvQ=
-github.com/go-ldap/ldap/v3 v3.4.8/go.mod h1:qS3Sjlu76eHfHGpUdWkAXQTw4beih+cHsco2jXlIXrk=
+github.com/go-ldap/ldap/v3 v3.4.10 h1:ot/iwPOhfpNVgB1o+AVXljizWZ9JTp7YF5oeyONmcJU=
+github.com/go-ldap/ldap/v3 v3.4.10/go.mod h1:JXh4Uxgi40P6E9rdsYqpUtbW46D9UTjJ9QSwGRznplY=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -201,8 +201,8 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/vmihailenco/msgpack/v4 v4.3.12/go.mod h1:gborTTJjAo/GWTqqRjrLCn9pgNN+NXzzngzBKDPIqw4=
 github.com/vmihailenco/tagparser v0.1.1/go.mod h1:OeAg3pn3UbLjkWt+rN9oFYB6u/cQgqMEUPoW2WPyhdI=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -212,8 +212,8 @@ github.com/zclconf/go-cty v1.8.0 h1:s4AvqaeQzJIu3ndv4gVIhplVD0krU+bgrcLSVUnaWuA=
 github.com/zclconf/go-cty v1.8.0/go.mod h1:vVKLxnk3puL4qRAv72AO+W99LUD4da90g3uUAzyuvAk=
 go.etcd.io/etcd/api/v3 v3.5.17 h1:cQB8eb8bxwuxOilBpMJAEo8fAONyrdXTHUNcMd8yT1w=
 go.etcd.io/etcd/api/v3 v3.5.17/go.mod h1:d1hvkRuXkts6PmaYk2Vrgqbv7H4ADfAKhyJqHNLJCB4=
-go.etcd.io/etcd/client/pkg/v3 v3.5.17 h1:XxnDXAWq2pnxqx76ljWwiQ9jylbpC4rvkAeRVOUKKVw=
-go.etcd.io/etcd/client/pkg/v3 v3.5.17/go.mod h1:4DqK1TKacp/86nJk4FLQqo6Mn2vvQFBmruW3pP14H/w=
+go.etcd.io/etcd/client/pkg/v3 v3.5.18 h1:mZPOYw4h8rTk7TeJ5+3udUkfVGBqc+GCjOJYd68QgNM=
+go.etcd.io/etcd/client/pkg/v3 v3.5.18/go.mod h1:BxVf2o5wXG9ZJV+/Cu7QNUiJYk4A29sAhoI5tIRsCu4=
 go.etcd.io/etcd/client/v3 v3.5.17 h1:o48sINNeWz5+pjy/Z0+HKpj/xSnBkuVhVvXkjEXbqZY=
 go.etcd.io/etcd/client/v3 v3.5.17/go.mod h1:j2d4eXTHWkT2ClBgnnEPm/Wuu7jsqku41v9DZ3OtjQo=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0 h1:r6I7RJCN86bpD/FQwedZ0vSixDpwuWREjW9oRMsmqDc=
@@ -241,8 +241,10 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
-golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
+golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
 golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
 golang.org/x/exp v0.0.0-20221004215720-b9f4876ce741 h1:fGZugkZk2UgYBxtpKmvub51Yno1LJDeEsRp2xGD+0gY=
@@ -251,6 +253,8 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0 h1:zY54UmvipHiNd+pm+m0x9KhZ9hl1/7QNMyxXbc6ICqA=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -265,8 +269,10 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
-golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
 golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
 golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
 golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
@@ -276,6 +282,9 @@ golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -287,16 +296,21 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
 golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
-golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
+golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
+golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -304,7 +318,9 @@ golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
@@ -315,6 +331,8 @@ golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roY
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -328,8 +346,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422 h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
 google.golang.org/grpc v1.69.4 h1:MF5TftSMkd8GLw/m0KM6V8CMOCY6NZ1NQDPGFgbTt4A=
 google.golang.org/grpc v1.69.4/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
-google.golang.org/protobuf v1.36.2 h1:R8FeyR1/eLmkutZOM5CWghmo5itiG9z0ktFlTVLuTmU=
-google.golang.org/protobuf v1.36.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.4 h1:6A3ZDJHn/eNqc1i+IdefRzy/9PokBTPvcqMySR7NNIM=
+google.golang.org/protobuf v1.36.4/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
diff --git a/server/api.go b/server/api.go
index 4454c3ca..5b0abb0b 100644
--- a/server/api.go
+++ b/server/api.go
@@ -51,7 +51,7 @@ type dexAPI struct {
 }
 
 func (d dexAPI) GetClient(ctx context.Context, req *api.GetClientReq) (*api.GetClientResp, error) {
-	c, err := d.s.GetClient(req.Id)
+	c, err := d.s.GetClient(ctx, req.Id)
 	if err != nil {
 		return nil, err
 	}
@@ -108,7 +108,7 @@ func (d dexAPI) UpdateClient(ctx context.Context, req *api.UpdateClientReq) (*ap
 		return nil, errors.New("update client: no client ID supplied")
 	}
 
-	err := d.s.UpdateClient(req.Id, func(old storage.Client) (storage.Client, error) {
+	err := d.s.UpdateClient(ctx, req.Id, func(old storage.Client) (storage.Client, error) {
 		if req.RedirectUris != nil {
 			old.RedirectURIs = req.RedirectUris
 		}
@@ -134,7 +134,7 @@ func (d dexAPI) UpdateClient(ctx context.Context, req *api.UpdateClientReq) (*ap
 }
 
 func (d dexAPI) DeleteClient(ctx context.Context, req *api.DeleteClientReq) (*api.DeleteClientResp, error) {
-	err := d.s.DeleteClient(req.Id)
+	err := d.s.DeleteClient(ctx, req.Id)
 	if err != nil {
 		if err == storage.ErrNotFound {
 			return &api.DeleteClientResp{NotFound: true}, nil
@@ -219,7 +219,7 @@ func (d dexAPI) UpdatePassword(ctx context.Context, req *api.UpdatePasswordReq)
 		return old, nil
 	}
 
-	if err := d.s.UpdatePassword(req.Email, updater); err != nil {
+	if err := d.s.UpdatePassword(ctx, req.Email, updater); err != nil {
 		if err == storage.ErrNotFound {
 			return &api.UpdatePasswordResp{NotFound: true}, nil
 		}
@@ -235,7 +235,7 @@ func (d dexAPI) DeletePassword(ctx context.Context, req *api.DeletePasswordReq)
 		return nil, errors.New("no email supplied")
 	}
 
-	err := d.s.DeletePassword(req.Email)
+	err := d.s.DeletePassword(ctx, req.Email)
 	if err != nil {
 		if err == storage.ErrNotFound {
 			return &api.DeletePasswordResp{NotFound: true}, nil
@@ -268,7 +268,7 @@ func (d dexAPI) GetDiscovery(ctx context.Context, req *api.DiscoveryReq) (*api.D
 }
 
 func (d dexAPI) ListPasswords(ctx context.Context, req *api.ListPasswordReq) (*api.ListPasswordResp, error) {
-	passwordList, err := d.s.ListPasswords()
+	passwordList, err := d.s.ListPasswords(ctx)
 	if err != nil {
 		d.logger.Error("failed to list passwords", "err", err)
 		return nil, fmt.Errorf("list passwords: %v", err)
@@ -298,7 +298,7 @@ func (d dexAPI) VerifyPassword(ctx context.Context, req *api.VerifyPasswordReq)
 		return nil, errors.New("no password to verify supplied")
 	}
 
-	password, err := d.s.GetPassword(req.Email)
+	password, err := d.s.GetPassword(ctx, req.Email)
 	if err != nil {
 		if err == storage.ErrNotFound {
 			return &api.VerifyPasswordResp{
@@ -327,7 +327,7 @@ func (d dexAPI) ListRefresh(ctx context.Context, req *api.ListRefreshReq) (*api.
 		return nil, err
 	}
 
-	offlineSessions, err := d.s.GetOfflineSessions(id.UserId, id.ConnId)
+	offlineSessions, err := d.s.GetOfflineSessions(ctx, id.UserId, id.ConnId)
 	if err != nil {
 		if err == storage.ErrNotFound {
 			// This means that this user-client pair does not have a refresh token yet.
@@ -381,7 +381,7 @@ func (d dexAPI) RevokeRefresh(ctx context.Context, req *api.RevokeRefreshReq) (*
 		return old, nil
 	}
 
-	if err := d.s.UpdateOfflineSessions(id.UserId, id.ConnId, updater); err != nil {
+	if err := d.s.UpdateOfflineSessions(ctx, id.UserId, id.ConnId, updater); err != nil {
 		if err == storage.ErrNotFound {
 			return &api.RevokeRefreshResp{NotFound: true}, nil
 		}
@@ -397,7 +397,7 @@ func (d dexAPI) RevokeRefresh(ctx context.Context, req *api.RevokeRefreshReq) (*
 	//
 	// TODO(ericchiang): we don't have any good recourse if this call fails.
 	// Consider garbage collection of refresh tokens with no associated ref.
-	if err := d.s.DeleteRefresh(refreshID); err != nil {
+	if err := d.s.DeleteRefresh(ctx, refreshID); err != nil {
 		d.logger.Error("failed to delete refresh token", "err", err)
 		return nil, err
 	}
@@ -448,7 +448,7 @@ func (d dexAPI) CreateConnector(ctx context.Context, req *api.CreateConnectorReq
 	return &api.CreateConnectorResp{}, nil
 }
 
-func (d dexAPI) UpdateConnector(_ context.Context, req *api.UpdateConnectorReq) (*api.UpdateConnectorResp, error) {
+func (d dexAPI) UpdateConnector(ctx context.Context, req *api.UpdateConnectorReq) (*api.UpdateConnectorResp, error) {
 	if !featureflags.APIConnectorsCRUD.Enabled() {
 		return nil, fmt.Errorf("%s feature flag is not enabled", featureflags.APIConnectorsCRUD.Name)
 	}
@@ -485,7 +485,7 @@ func (d dexAPI) UpdateConnector(_ context.Context, req *api.UpdateConnectorReq)
 		return old, nil
 	}
 
-	if err := d.s.UpdateConnector(req.Id, updater); err != nil {
+	if err := d.s.UpdateConnector(ctx, req.Id, updater); err != nil {
 		if err == storage.ErrNotFound {
 			return &api.UpdateConnectorResp{NotFound: true}, nil
 		}
@@ -505,7 +505,7 @@ func (d dexAPI) DeleteConnector(ctx context.Context, req *api.DeleteConnectorReq
 		return nil, errors.New("no id supplied")
 	}
 
-	err := d.s.DeleteConnector(req.Id)
+	err := d.s.DeleteConnector(ctx, req.Id)
 	if err != nil {
 		if err == storage.ErrNotFound {
 			return &api.DeleteConnectorResp{NotFound: true}, nil
@@ -521,7 +521,7 @@ func (d dexAPI) ListConnectors(ctx context.Context, req *api.ListConnectorReq) (
 		return nil, fmt.Errorf("%s feature flag is not enabled", featureflags.APIConnectorsCRUD.Name)
 	}
 
-	connectorList, err := d.s.ListConnectors()
+	connectorList, err := d.s.ListConnectors(ctx)
 	if err != nil {
 		d.logger.Error("api: failed to list connectors", "err", err)
 		return nil, fmt.Errorf("list connectors: %v", err)
diff --git a/server/deviceflowhandlers.go b/server/deviceflowhandlers.go
index 06f3a7b2..380e40aa 100644
--- a/server/deviceflowhandlers.go
+++ b/server/deviceflowhandlers.go
@@ -199,6 +199,7 @@ func (s *Server) handleDeviceTokenDeprecated(w http.ResponseWriter, r *http.Requ
 }
 
 func (s *Server) handleDeviceToken(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
 	deviceCode := r.Form.Get("device_code")
 	if deviceCode == "" {
 		s.tokenErrHelper(w, errInvalidRequest, "No device code received", http.StatusBadRequest)
@@ -208,7 +209,7 @@ func (s *Server) handleDeviceToken(w http.ResponseWriter, r *http.Request) {
 	now := s.now()
 
 	// Grab the device token, check validity
-	deviceToken, err := s.storage.GetDeviceToken(deviceCode)
+	deviceToken, err := s.storage.GetDeviceToken(ctx, deviceCode)
 	if err != nil {
 		if err != storage.ErrNotFound {
 			s.logger.ErrorContext(r.Context(), "failed to get device code", "err", err)
@@ -240,7 +241,7 @@ func (s *Server) handleDeviceToken(w http.ResponseWriter, r *http.Request) {
 			return old, nil
 		}
 		// Update device token last request time in storage
-		if err := s.storage.UpdateDeviceToken(deviceCode, updater); err != nil {
+		if err := s.storage.UpdateDeviceToken(ctx, deviceCode, updater); err != nil {
 			s.logger.ErrorContext(r.Context(), "failed to update device token", "err", err)
 			s.renderError(r, w, http.StatusInternalServerError, "")
 			return
@@ -299,7 +300,7 @@ func (s *Server) handleDeviceCallback(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		authCode, err := s.storage.GetAuthCode(code)
+		authCode, err := s.storage.GetAuthCode(ctx, code)
 		if err != nil || s.now().After(authCode.Expiry) {
 			errCode := http.StatusBadRequest
 			if err != nil && err != storage.ErrNotFound {
@@ -311,7 +312,7 @@ func (s *Server) handleDeviceCallback(w http.ResponseWriter, r *http.Request) {
 		}
 
 		// Grab the device request from storage
-		deviceReq, err := s.storage.GetDeviceRequest(userCode)
+		deviceReq, err := s.storage.GetDeviceRequest(ctx, userCode)
 		if err != nil || s.now().After(deviceReq.Expiry) {
 			errCode := http.StatusBadRequest
 			if err != nil && err != storage.ErrNotFound {
@@ -322,7 +323,7 @@ func (s *Server) handleDeviceCallback(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		client, err := s.storage.GetClient(deviceReq.ClientID)
+		client, err := s.storage.GetClient(ctx, deviceReq.ClientID)
 		if err != nil {
 			if err != storage.ErrNotFound {
 				s.logger.ErrorContext(r.Context(), "failed to get client", "err", err)
@@ -345,7 +346,7 @@ func (s *Server) handleDeviceCallback(w http.ResponseWriter, r *http.Request) {
 		}
 
 		// Grab the device token from storage
-		old, err := s.storage.GetDeviceToken(deviceReq.DeviceCode)
+		old, err := s.storage.GetDeviceToken(ctx, deviceReq.DeviceCode)
 		if err != nil || s.now().After(old.Expiry) {
 			errCode := http.StatusBadRequest
 			if err != nil && err != storage.ErrNotFound {
@@ -373,7 +374,7 @@ func (s *Server) handleDeviceCallback(w http.ResponseWriter, r *http.Request) {
 		}
 
 		// Update refresh token in the storage, store the token and mark as complete
-		if err := s.storage.UpdateDeviceToken(deviceReq.DeviceCode, updater); err != nil {
+		if err := s.storage.UpdateDeviceToken(ctx, deviceReq.DeviceCode, updater); err != nil {
 			s.logger.ErrorContext(r.Context(), "failed to update device token", "err", err)
 			s.renderError(r, w, http.StatusBadRequest, "")
 			return
@@ -391,6 +392,7 @@ func (s *Server) handleDeviceCallback(w http.ResponseWriter, r *http.Request) {
 }
 
 func (s *Server) verifyUserCode(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
 	switch r.Method {
 	case http.MethodPost:
 		err := r.ParseForm()
@@ -409,7 +411,7 @@ func (s *Server) verifyUserCode(w http.ResponseWriter, r *http.Request) {
 		userCode = strings.ToUpper(userCode)
 
 		// Find the user code in the available requests
-		deviceRequest, err := s.storage.GetDeviceRequest(userCode)
+		deviceRequest, err := s.storage.GetDeviceRequest(ctx, userCode)
 		if err != nil || s.now().After(deviceRequest.Expiry) {
 			if err != nil && err != storage.ErrNotFound {
 				s.logger.ErrorContext(r.Context(), "failed to get device request", "err", err)
diff --git a/server/handlers.go b/server/handlers.go
index 5954820c..a00b290b 100644
--- a/server/handlers.go
+++ b/server/handlers.go
@@ -32,8 +32,9 @@ const (
 )
 
 func (s *Server) handlePublicKeys(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
 	// TODO(ericchiang): Cache this.
-	keys, err := s.storage.GetKeys()
+	keys, err := s.storage.GetKeys(ctx)
 	if err != nil {
 		s.logger.ErrorContext(r.Context(), "failed to get keys", "err", err)
 		s.renderError(r, w, http.StatusInternalServerError, "Internal server error.")
@@ -135,6 +136,7 @@ func (s *Server) constructDiscovery() discovery {
 
 // handleAuthorization handles the OAuth2 auth endpoint.
 func (s *Server) handleAuthorization(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
 	// Extract the arguments
 	if err := r.ParseForm(); err != nil {
 		s.logger.ErrorContext(r.Context(), "failed to parse arguments", "err", err)
@@ -144,8 +146,7 @@ func (s *Server) handleAuthorization(w http.ResponseWriter, r *http.Request) {
 	}
 
 	connectorID := r.Form.Get("connector_id")
-
-	connectors, err := s.storage.ListConnectors()
+	connectors, err := s.storage.ListConnectors(ctx)
 	if err != nil {
 		s.logger.ErrorContext(r.Context(), "failed to get list of connectors", "err", err)
 		s.renderError(r, w, http.StatusInternalServerError, "Failed to retrieve connector list.")
@@ -219,7 +220,7 @@ func (s *Server) handleConnectorLogin(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	conn, err := s.getConnector(connID)
+	conn, err := s.getConnector(ctx, connID)
 	if err != nil {
 		s.logger.ErrorContext(r.Context(), "Failed to get connector", "err", err)
 		s.renderError(r, w, http.StatusBadRequest, "Requested resource does not exist")
@@ -314,6 +315,7 @@ func (s *Server) handleConnectorLogin(w http.ResponseWriter, r *http.Request) {
 }
 
 func (s *Server) handlePasswordLogin(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
 	authID := r.URL.Query().Get("state")
 	if authID == "" {
 		s.renderError(r, w, http.StatusBadRequest, "User session error.")
@@ -322,7 +324,7 @@ func (s *Server) handlePasswordLogin(w http.ResponseWriter, r *http.Request) {
 
 	backLink := r.URL.Query().Get("back")
 
-	authReq, err := s.storage.GetAuthRequest(authID)
+	authReq, err := s.storage.GetAuthRequest(ctx, authID)
 	if err != nil {
 		if err == storage.ErrNotFound {
 			s.logger.ErrorContext(r.Context(), "invalid 'state' parameter provided", "err", err)
@@ -345,7 +347,7 @@ func (s *Server) handlePasswordLogin(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	conn, err := s.getConnector(authReq.ConnectorID)
+	conn, err := s.getConnector(ctx, authReq.ConnectorID)
 	if err != nil {
 		s.logger.ErrorContext(r.Context(), "failed to get connector", "connector_id", authReq.ConnectorID, "err", err)
 		s.renderError(r, w, http.StatusInternalServerError, "Requested resource does not exist.")
@@ -390,7 +392,7 @@ func (s *Server) handlePasswordLogin(w http.ResponseWriter, r *http.Request) {
 		}
 
 		if canSkipApproval {
-			authReq, err = s.storage.GetAuthRequest(authReq.ID)
+			authReq, err = s.storage.GetAuthRequest(ctx, authReq.ID)
 			if err != nil {
 				s.logger.ErrorContext(r.Context(), "failed to get finalized auth request", "err", err)
 				s.renderError(r, w, http.StatusInternalServerError, "Login error.")
@@ -425,7 +427,7 @@ func (s *Server) handleConnectorCallback(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	authReq, err := s.storage.GetAuthRequest(authID)
+	authReq, err := s.storage.GetAuthRequest(ctx, authID)
 	if err != nil {
 		if err == storage.ErrNotFound {
 			s.logger.ErrorContext(r.Context(), "invalid 'state' parameter provided", "err", err)
@@ -448,7 +450,7 @@ func (s *Server) handleConnectorCallback(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	conn, err := s.getConnector(authReq.ConnectorID)
+	conn, err := s.getConnector(ctx, authReq.ConnectorID)
 	if err != nil {
 		s.logger.ErrorContext(r.Context(), "failed to get connector", "connector_id", authReq.ConnectorID, "err", err)
 		s.renderError(r, w, http.StatusInternalServerError, "Requested resource does not exist.")
@@ -490,7 +492,7 @@ func (s *Server) handleConnectorCallback(w http.ResponseWriter, r *http.Request)
 	}
 
 	if canSkipApproval {
-		authReq, err = s.storage.GetAuthRequest(authReq.ID)
+		authReq, err = s.storage.GetAuthRequest(ctx, authReq.ID)
 		if err != nil {
 			s.logger.ErrorContext(r.Context(), "failed to get finalized auth request", "err", err)
 			s.renderError(r, w, http.StatusInternalServerError, "Login error.")
@@ -521,7 +523,7 @@ func (s *Server) finalizeLogin(ctx context.Context, identity connector.Identity,
 		a.ConnectorData = identity.ConnectorData
 		return a, nil
 	}
-	if err := s.storage.UpdateAuthRequest(authReq.ID, updater); err != nil {
+	if err := s.storage.UpdateAuthRequest(ctx, authReq.ID, updater); err != nil {
 		return "", false, fmt.Errorf("failed to update auth request: %v", err)
 	}
 
@@ -545,7 +547,7 @@ func (s *Server) finalizeLogin(ctx context.Context, identity connector.Identity,
 
 	if offlineAccessRequested && canRefresh {
 		// Try to retrieve an existing OfflineSession object for the corresponding user.
-		session, err := s.storage.GetOfflineSessions(identity.UserID, authReq.ConnectorID)
+		session, err := s.storage.GetOfflineSessions(ctx, identity.UserID, authReq.ConnectorID)
 		switch {
 		case err != nil && err == storage.ErrNotFound:
 			offlineSessions := storage.OfflineSessions{
@@ -563,7 +565,7 @@ func (s *Server) finalizeLogin(ctx context.Context, identity connector.Identity,
 			}
 		case err == nil:
 			// Update existing OfflineSession obj with new RefreshTokenRef.
-			if err := s.storage.UpdateOfflineSessions(session.UserID, session.ConnID, func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
+			if err := s.storage.UpdateOfflineSessions(ctx, session.UserID, session.ConnID, func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
 				if len(identity.ConnectorData) > 0 {
 					old.ConnectorData = identity.ConnectorData
 				}
@@ -594,6 +596,7 @@ func (s *Server) finalizeLogin(ctx context.Context, identity connector.Identity,
 }
 
 func (s *Server) handleApproval(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
 	macEncoded := r.FormValue("hmac")
 	if macEncoded == "" {
 		s.renderError(r, w, http.StatusUnauthorized, "Unauthorized request")
@@ -605,7 +608,7 @@ func (s *Server) handleApproval(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	authReq, err := s.storage.GetAuthRequest(r.FormValue("req"))
+	authReq, err := s.storage.GetAuthRequest(ctx, r.FormValue("req"))
 	if err != nil {
 		s.logger.ErrorContext(r.Context(), "failed to get auth request", "err", err)
 		s.renderError(r, w, http.StatusInternalServerError, "Database error.")
@@ -629,7 +632,7 @@ func (s *Server) handleApproval(w http.ResponseWriter, r *http.Request) {
 
 	switch r.Method {
 	case http.MethodGet:
-		client, err := s.storage.GetClient(authReq.ClientID)
+		client, err := s.storage.GetClient(ctx, authReq.ClientID)
 		if err != nil {
 			s.logger.ErrorContext(r.Context(), "Failed to get client", "client_id", authReq.ClientID, "err", err)
 			s.renderError(r, w, http.StatusInternalServerError, "Failed to retrieve client.")
@@ -654,7 +657,7 @@ func (s *Server) sendCodeResponse(w http.ResponseWriter, r *http.Request, authRe
 		return
 	}
 
-	if err := s.storage.DeleteAuthRequest(authReq.ID); err != nil {
+	if err := s.storage.DeleteAuthRequest(ctx, authReq.ID); err != nil {
 		if err != storage.ErrNotFound {
 			s.logger.ErrorContext(r.Context(), "Failed to delete authorization request", "err", err)
 			s.renderError(r, w, http.StatusInternalServerError, "Internal server error.")
@@ -786,6 +789,7 @@ func (s *Server) sendCodeResponse(w http.ResponseWriter, r *http.Request, authRe
 }
 
 func (s *Server) withClientFromStorage(w http.ResponseWriter, r *http.Request, handler func(http.ResponseWriter, *http.Request, storage.Client)) {
+	ctx := r.Context()
 	clientID, clientSecret, ok := r.BasicAuth()
 	if ok {
 		var err error
@@ -802,7 +806,7 @@ func (s *Server) withClientFromStorage(w http.ResponseWriter, r *http.Request, h
 		clientSecret = r.PostFormValue("client_secret")
 	}
 
-	client, err := s.storage.GetClient(clientID)
+	client, err := s.storage.GetClient(ctx, clientID)
 	if err != nil {
 		if err != storage.ErrNotFound {
 			s.logger.ErrorContext(r.Context(), "failed to get client", "err", err)
@@ -885,7 +889,7 @@ func (s *Server) handleAuthCode(w http.ResponseWriter, r *http.Request, client s
 		return
 	}
 
-	authCode, err := s.storage.GetAuthCode(code)
+	authCode, err := s.storage.GetAuthCode(ctx, code)
 	if err != nil || s.now().After(authCode.Expiry) || authCode.ClientID != client.ID {
 		if err != storage.ErrNotFound {
 			s.logger.ErrorContext(r.Context(), "failed to get auth code", "err", err)
@@ -950,7 +954,7 @@ func (s *Server) exchangeAuthCode(ctx context.Context, w http.ResponseWriter, au
 		return nil, err
 	}
 
-	if err := s.storage.DeleteAuthCode(authCode.ID); err != nil {
+	if err := s.storage.DeleteAuthCode(ctx, authCode.ID); err != nil {
 		s.logger.ErrorContext(ctx, "failed to delete auth code", "err", err)
 		s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
 		return nil, err
@@ -960,7 +964,7 @@ func (s *Server) exchangeAuthCode(ctx context.Context, w http.ResponseWriter, au
 		// Ensure the connector supports refresh tokens.
 		//
 		// Connectors like `saml` do not implement RefreshConnector.
-		conn, err := s.getConnector(authCode.ConnectorID)
+		conn, err := s.getConnector(ctx, authCode.ConnectorID)
 		if err != nil {
 			s.logger.ErrorContext(ctx, "connector not found", "connector_id", authCode.ConnectorID, "err", err)
 			s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
@@ -1016,7 +1020,7 @@ func (s *Server) exchangeAuthCode(ctx context.Context, w http.ResponseWriter, au
 		defer func() {
 			if deleteToken {
 				// Delete newly created refresh token from storage.
-				if err := s.storage.DeleteRefresh(refresh.ID); err != nil {
+				if err := s.storage.DeleteRefresh(ctx, refresh.ID); err != nil {
 					s.logger.ErrorContext(ctx, "failed to delete refresh token", "err", err)
 					s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
 					return
@@ -1032,7 +1036,7 @@ func (s *Server) exchangeAuthCode(ctx context.Context, w http.ResponseWriter, au
 		}
 
 		// Try to retrieve an existing OfflineSession object for the corresponding user.
-		if session, err := s.storage.GetOfflineSessions(refresh.Claims.UserID, refresh.ConnectorID); err != nil {
+		if session, err := s.storage.GetOfflineSessions(ctx, refresh.Claims.UserID, refresh.ConnectorID); err != nil {
 			if err != storage.ErrNotFound {
 				s.logger.ErrorContext(ctx, "failed to get offline session", "err", err)
 				s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
@@ -1057,7 +1061,7 @@ func (s *Server) exchangeAuthCode(ctx context.Context, w http.ResponseWriter, au
 		} else {
 			if oldTokenRef, ok := session.Refresh[tokenRef.ClientID]; ok {
 				// Delete old refresh token from storage.
-				if err := s.storage.DeleteRefresh(oldTokenRef.ID); err != nil && err != storage.ErrNotFound {
+				if err := s.storage.DeleteRefresh(ctx, oldTokenRef.ID); err != nil && err != storage.ErrNotFound {
 					s.logger.ErrorContext(ctx, "failed to delete refresh token", "err", err)
 					s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
 					deleteToken = true
@@ -1066,7 +1070,7 @@ func (s *Server) exchangeAuthCode(ctx context.Context, w http.ResponseWriter, au
 			}
 
 			// Update existing OfflineSession obj with new RefreshTokenRef.
-			if err := s.storage.UpdateOfflineSessions(session.UserID, session.ConnID, func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
+			if err := s.storage.UpdateOfflineSessions(ctx, session.UserID, session.ConnID, func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
 				old.Refresh[tokenRef.ClientID] = &tokenRef
 				return old, nil
 			}); err != nil {
@@ -1140,7 +1144,7 @@ func (s *Server) handlePasswordGrant(w http.ResponseWriter, r *http.Request, cli
 				continue
 			}
 
-			isTrusted, err := s.validateCrossClientTrust(r.Context(), client.ID, peerID)
+			isTrusted, err := s.validateCrossClientTrust(ctx, client.ID, peerID)
 			if err != nil {
 				s.tokenErrHelper(w, errInvalidClient, fmt.Sprintf("Error validating cross client trust %v.", err), http.StatusBadRequest)
 				return
@@ -1165,7 +1169,7 @@ func (s *Server) handlePasswordGrant(w http.ResponseWriter, r *http.Request, cli
 
 	// Which connector
 	connID := s.passwordConnector
-	conn, err := s.getConnector(connID)
+	conn, err := s.getConnector(ctx, connID)
 	if err != nil {
 		s.tokenErrHelper(w, errInvalidRequest, "Requested connector does not exist.", http.StatusBadRequest)
 		return
@@ -1201,14 +1205,14 @@ func (s *Server) handlePasswordGrant(w http.ResponseWriter, r *http.Request, cli
 		Groups:            identity.Groups,
 	}
 
-	accessToken, _, err := s.newAccessToken(r.Context(), client.ID, claims, scopes, nonce, connID)
+	accessToken, _, err := s.newAccessToken(ctx, client.ID, claims, scopes, nonce, connID)
 	if err != nil {
 		s.logger.ErrorContext(r.Context(), "password grant failed to create new access token", "err", err)
 		s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
 		return
 	}
 
-	idToken, expiry, err := s.newIDToken(r.Context(), client.ID, claims, scopes, nonce, accessToken, "", connID)
+	idToken, expiry, err := s.newIDToken(ctx, client.ID, claims, scopes, nonce, accessToken, "", connID)
 	if err != nil {
 		s.logger.ErrorContext(r.Context(), "password grant failed to create new ID token", "err", err)
 		s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
@@ -1268,7 +1272,7 @@ func (s *Server) handlePasswordGrant(w http.ResponseWriter, r *http.Request, cli
 		defer func() {
 			if deleteToken {
 				// Delete newly created refresh token from storage.
-				if err := s.storage.DeleteRefresh(refresh.ID); err != nil {
+				if err := s.storage.DeleteRefresh(ctx, refresh.ID); err != nil {
 					s.logger.ErrorContext(r.Context(), "failed to delete refresh token", "err", err)
 					s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
 					return
@@ -1284,7 +1288,7 @@ func (s *Server) handlePasswordGrant(w http.ResponseWriter, r *http.Request, cli
 		}
 
 		// Try to retrieve an existing OfflineSession object for the corresponding user.
-		if session, err := s.storage.GetOfflineSessions(refresh.Claims.UserID, refresh.ConnectorID); err != nil {
+		if session, err := s.storage.GetOfflineSessions(ctx, refresh.Claims.UserID, refresh.ConnectorID); err != nil {
 			if err != storage.ErrNotFound {
 				s.logger.ErrorContext(r.Context(), "failed to get offline session", "err", err)
 				s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
@@ -1310,7 +1314,7 @@ func (s *Server) handlePasswordGrant(w http.ResponseWriter, r *http.Request, cli
 		} else {
 			if oldTokenRef, ok := session.Refresh[tokenRef.ClientID]; ok {
 				// Delete old refresh token from storage.
-				if err := s.storage.DeleteRefresh(oldTokenRef.ID); err != nil {
+				if err := s.storage.DeleteRefresh(ctx, oldTokenRef.ID); err != nil {
 					if err == storage.ErrNotFound {
 						s.logger.Warn("database inconsistent, refresh token missing", "token_id", oldTokenRef.ID)
 					} else {
@@ -1323,7 +1327,7 @@ func (s *Server) handlePasswordGrant(w http.ResponseWriter, r *http.Request, cli
 			}
 
 			// Update existing OfflineSession obj with new RefreshTokenRef.
-			if err := s.storage.UpdateOfflineSessions(session.UserID, session.ConnID, func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
+			if err := s.storage.UpdateOfflineSessions(ctx, session.UserID, session.ConnID, func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
 				old.Refresh[tokenRef.ClientID] = &tokenRef
 				old.ConnectorData = identity.ConnectorData
 				return old, nil
@@ -1371,7 +1375,7 @@ func (s *Server) handleTokenExchange(w http.ResponseWriter, r *http.Request, cli
 		return
 	}
 
-	conn, err := s.getConnector(connID)
+	conn, err := s.getConnector(ctx, connID)
 	if err != nil {
 		s.logger.ErrorContext(r.Context(), "failed to get connector", "err", err)
 		s.tokenErrHelper(w, errInvalidRequest, "Requested connector does not exist.", http.StatusBadRequest)
diff --git a/server/introspectionhandler.go b/server/introspectionhandler.go
index 802e29b6..42ad1b3c 100644
--- a/server/introspectionhandler.go
+++ b/server/introspectionhandler.go
@@ -263,7 +263,7 @@ func (s *Server) introspectAccessToken(ctx context.Context, token string) (*Intr
 		return nil, newIntrospectInternalServerError()
 	}
 
-	client, err := s.storage.GetClient(clientID)
+	client, err := s.storage.GetClient(ctx, clientID)
 	if err != nil {
 		s.logger.ErrorContext(ctx, "error while fetching client from storage", "err", err.Error())
 		return nil, newIntrospectInternalServerError()
diff --git a/server/oauth2.go b/server/oauth2.go
index cc81a8a5..18cc3dd4 100644
--- a/server/oauth2.go
+++ b/server/oauth2.go
@@ -351,7 +351,7 @@ func genSubject(userID string, connID string) (string, error) {
 }
 
 func (s *Server) newIDToken(ctx context.Context, clientID string, claims storage.Claims, scopes []string, nonce, accessToken, code, connID string) (idToken string, expiry time.Time, err error) {
-	keys, err := s.storage.GetKeys()
+	keys, err := s.storage.GetKeys(ctx)
 	if err != nil {
 		s.logger.ErrorContext(ctx, "failed to get keys", "err", err)
 		return "", expiry, err
@@ -453,6 +453,7 @@ func (s *Server) newIDToken(ctx context.Context, clientID string, claims storage
 
 // parse the initial request from the OAuth2 client.
 func (s *Server) parseAuthorizationRequest(r *http.Request) (*storage.AuthRequest, error) {
+	ctx := r.Context()
 	if err := r.ParseForm(); err != nil {
 		return nil, newDisplayedErr(http.StatusBadRequest, "Failed to parse request.")
 	}
@@ -477,7 +478,7 @@ func (s *Server) parseAuthorizationRequest(r *http.Request) (*storage.AuthReques
 		codeChallengeMethod = codeChallengeMethodPlain
 	}
 
-	client, err := s.storage.GetClient(clientID)
+	client, err := s.storage.GetClient(ctx, clientID)
 	if err != nil {
 		if err == storage.ErrNotFound {
 			return nil, newDisplayedErr(http.StatusNotFound, "Invalid client_id (%q).", clientID)
@@ -499,7 +500,7 @@ func (s *Server) parseAuthorizationRequest(r *http.Request) (*storage.AuthReques
 	}
 
 	if connectorID != "" {
-		connectors, err := s.storage.ListConnectors()
+		connectors, err := s.storage.ListConnectors(ctx)
 		if err != nil {
 			s.logger.ErrorContext(r.Context(), "failed to list connectors", "err", err)
 			return nil, newRedirectedErr(errServerError, "Unable to retrieve connectors")
@@ -634,7 +635,7 @@ func (s *Server) validateCrossClientTrust(ctx context.Context, clientID, peerID
 	if peerID == clientID {
 		return true, nil
 	}
-	peer, err := s.storage.GetClient(peerID)
+	peer, err := s.storage.GetClient(ctx, peerID)
 	if err != nil {
 		if err != storage.ErrNotFound {
 			s.logger.ErrorContext(ctx, "failed to get client", "err", err)
@@ -707,7 +708,7 @@ type storageKeySet struct {
 	storage.Storage
 }
 
-func (s *storageKeySet) VerifySignature(_ context.Context, jwt string) (payload []byte, err error) {
+func (s *storageKeySet) VerifySignature(ctx context.Context, jwt string) (payload []byte, err error) {
 	jws, err := jose.ParseSigned(jwt, []jose.SignatureAlgorithm{jose.RS256, jose.RS384, jose.RS512, jose.ES256, jose.ES384, jose.ES512})
 	if err != nil {
 		return nil, err
@@ -719,7 +720,7 @@ func (s *storageKeySet) VerifySignature(_ context.Context, jwt string) (payload
 		break
 	}
 
-	skeys, err := s.Storage.GetKeys()
+	skeys, err := s.Storage.GetKeys(ctx)
 	if err != nil {
 		return nil, err
 	}
diff --git a/server/refreshhandlers.go b/server/refreshhandlers.go
index 391d5522..de8d9b7b 100644
--- a/server/refreshhandlers.go
+++ b/server/refreshhandlers.go
@@ -84,7 +84,7 @@ func (s *Server) getRefreshTokenFromStorage(ctx context.Context, clientID *strin
 	refreshCtx := refreshContext{requestToken: token}
 
 	// Get RefreshToken
-	refresh, err := s.storage.GetRefresh(token.RefreshId)
+	refresh, err := s.storage.GetRefresh(ctx, token.RefreshId)
 	if err != nil {
 		if err != storage.ErrNotFound {
 			s.logger.ErrorContext(ctx, "failed to get refresh token", "err", err)
@@ -126,14 +126,14 @@ func (s *Server) getRefreshTokenFromStorage(ctx context.Context, clientID *strin
 	refreshCtx.storageToken = &refresh
 
 	// Get Connector
-	refreshCtx.connector, err = s.getConnector(refresh.ConnectorID)
+	refreshCtx.connector, err = s.getConnector(ctx, refresh.ConnectorID)
 	if err != nil {
 		s.logger.ErrorContext(ctx, "connector not found", "connector_id", refresh.ConnectorID, "err", err)
 		return nil, newInternalServerError()
 	}
 
 	// Get Connector Data
-	session, err := s.storage.GetOfflineSessions(refresh.Claims.UserID, refresh.ConnectorID)
+	session, err := s.storage.GetOfflineSessions(ctx, refresh.Claims.UserID, refresh.ConnectorID)
 	switch {
 	case err != nil:
 		if err != storage.ErrNotFound {
@@ -223,7 +223,7 @@ func (s *Server) updateOfflineSession(ctx context.Context, refresh *storage.Refr
 
 	// Update LastUsed time stamp in refresh token reference object
 	// in offline session for the user.
-	err := s.storage.UpdateOfflineSessions(refresh.Claims.UserID, refresh.ConnectorID, offlineSessionUpdater)
+	err := s.storage.UpdateOfflineSessions(ctx, refresh.Claims.UserID, refresh.ConnectorID, offlineSessionUpdater)
 	if err != nil {
 		s.logger.ErrorContext(ctx, "failed to update offline session", "err", err)
 		return newInternalServerError()
@@ -314,7 +314,7 @@ func (s *Server) updateRefreshToken(ctx context.Context, rCtx *refreshContext) (
 	}
 
 	// Update refresh token in the storage.
-	err := s.storage.UpdateRefreshToken(rCtx.storageToken.ID, refreshTokenUpdater)
+	err := s.storage.UpdateRefreshToken(ctx, rCtx.storageToken.ID, refreshTokenUpdater)
 	if err != nil {
 		s.logger.ErrorContext(ctx, "failed to update refresh token", "err", err)
 		return nil, ident, newInternalServerError()
diff --git a/server/rotation.go b/server/rotation.go
index dfd776d6..286b4b57 100644
--- a/server/rotation.go
+++ b/server/rotation.go
@@ -95,7 +95,7 @@ func (s *Server) startKeyRotation(ctx context.Context, strategy rotationStrategy
 }
 
 func (k keyRotator) rotate() error {
-	keys, err := k.GetKeys()
+	keys, err := k.GetKeys(context.Background())
 	if err != nil && err != storage.ErrNotFound {
 		return fmt.Errorf("get keys: %v", err)
 	}
@@ -128,7 +128,7 @@ func (k keyRotator) rotate() error {
 	}
 
 	var nextRotation time.Time
-	err = k.Storage.UpdateKeys(func(keys storage.Keys) (storage.Keys, error) {
+	err = k.Storage.UpdateKeys(context.Background(), func(keys storage.Keys) (storage.Keys, error) {
 		tNow := k.now()
 
 		// if you are running multiple instances of dex, another instance
diff --git a/server/server.go b/server/server.go
index 5c5faa30..8c046296 100644
--- a/server/server.go
+++ b/server/server.go
@@ -316,7 +316,7 @@ func newServer(ctx context.Context, c Config, rotationStrategy rotationStrategy)
 
 	// Retrieves connector objects in backend storage. This list includes the static connectors
 	// defined in the ConfigMap and dynamic connectors retrieved from the storage.
-	storageConnectors, err := c.Storage.ListConnectors()
+	storageConnectors, err := c.Storage.ListConnectors(ctx)
 	if err != nil {
 		return nil, fmt.Errorf("server: failed to list connector objects from storage: %v", err)
 	}
@@ -535,7 +535,7 @@ type passwordDB struct {
 }
 
 func (db passwordDB) Login(ctx context.Context, s connector.Scopes, email, password string) (connector.Identity, bool, error) {
-	p, err := db.s.GetPassword(email)
+	p, err := db.s.GetPassword(ctx, email)
 	if err != nil {
 		if err != storage.ErrNotFound {
 			return connector.Identity{}, false, fmt.Errorf("get password: %v", err)
@@ -560,7 +560,7 @@ func (db passwordDB) Login(ctx context.Context, s connector.Scopes, email, passw
 
 func (db passwordDB) Refresh(ctx context.Context, s connector.Scopes, identity connector.Identity) (connector.Identity, error) {
 	// If the user has been deleted, the refresh token will be rejected.
-	p, err := db.s.GetPassword(identity.Email)
+	p, err := db.s.GetPassword(ctx, identity.Email)
 	if err != nil {
 		if err == storage.ErrNotFound {
 			return connector.Identity{}, errors.New("user not found")
@@ -602,13 +602,13 @@ type keyCacher struct {
 	keys atomic.Value // Always holds nil or type *storage.Keys.
 }
 
-func (k *keyCacher) GetKeys() (storage.Keys, error) {
+func (k *keyCacher) GetKeys(ctx context.Context) (storage.Keys, error) {
 	keys, ok := k.keys.Load().(*storage.Keys)
 	if ok && keys != nil && k.now().Before(keys.NextRotation) {
 		return *keys, nil
 	}
 
-	storageKeys, err := k.Storage.GetKeys()
+	storageKeys, err := k.Storage.GetKeys(ctx)
 	if err != nil {
 		return storageKeys, err
 	}
@@ -626,7 +626,7 @@ func (s *Server) startGarbageCollection(ctx context.Context, frequency time.Dura
 			case <-ctx.Done():
 				return
 			case <-time.After(frequency):
-				if r, err := s.storage.GarbageCollect(now()); err != nil {
+				if r, err := s.storage.GarbageCollect(ctx, now()); err != nil {
 					s.logger.ErrorContext(ctx, "garbage collection failed", "err", err)
 				} else if !r.IsEmpty() {
 					s.logger.InfoContext(ctx, "garbage collection run, delete auth",
@@ -719,8 +719,8 @@ func (s *Server) OpenConnector(conn storage.Connector) (Connector, error) {
 
 // getConnector retrieves the connector object with the given id from the storage
 // and updates the connector list for server if necessary.
-func (s *Server) getConnector(id string) (Connector, error) {
-	storageConnector, err := s.storage.GetConnector(id)
+func (s *Server) getConnector(ctx context.Context, id string) (Connector, error) {
+	storageConnector, err := s.storage.GetConnector(ctx, id)
 	if err != nil {
 		return Connector{}, fmt.Errorf("failed to get connector object from storage: %v", err)
 	}
diff --git a/storage/conformance/conformance.go b/storage/conformance/conformance.go
index 84ad1cba..58ae3d95 100644
--- a/storage/conformance/conformance.go
+++ b/storage/conformance/conformance.go
@@ -148,7 +148,7 @@ func testAuthRequestCRUD(t *testing.T, s storage.Storage) {
 		t.Fatalf("failed creating auth request: %v", err)
 	}
 
-	if err := s.UpdateAuthRequest(a1.ID, func(old storage.AuthRequest) (storage.AuthRequest, error) {
+	if err := s.UpdateAuthRequest(ctx, a1.ID, func(old storage.AuthRequest) (storage.AuthRequest, error) {
 		old.Claims = identity
 		old.ConnectorID = "connID"
 		return old, nil
@@ -156,7 +156,7 @@ func testAuthRequestCRUD(t *testing.T, s storage.Storage) {
 		t.Fatalf("failed to update auth request: %v", err)
 	}
 
-	got, err := s.GetAuthRequest(a1.ID)
+	got, err := s.GetAuthRequest(ctx, a1.ID)
 	if err != nil {
 		t.Fatalf("failed to get auth req: %v", err)
 	}
@@ -168,15 +168,15 @@ func testAuthRequestCRUD(t *testing.T, s storage.Storage) {
 		t.Fatalf("storage does not support PKCE, wanted challenge=%#v got %#v", codeChallenge, got.PKCE)
 	}
 
-	if err := s.DeleteAuthRequest(a1.ID); err != nil {
+	if err := s.DeleteAuthRequest(ctx, a1.ID); err != nil {
 		t.Fatalf("failed to delete auth request: %v", err)
 	}
 
-	if err := s.DeleteAuthRequest(a2.ID); err != nil {
+	if err := s.DeleteAuthRequest(ctx, a2.ID); err != nil {
 		t.Fatalf("failed to delete auth request: %v", err)
 	}
 
-	_, err = s.GetAuthRequest(a1.ID)
+	_, err = s.GetAuthRequest(ctx, a1.ID)
 	mustBeErrNotFound(t, "auth request", err)
 }
 
@@ -234,7 +234,7 @@ func testAuthCodeCRUD(t *testing.T, s storage.Storage) {
 		t.Fatalf("failed creating auth code: %v", err)
 	}
 
-	got, err := s.GetAuthCode(a1.ID)
+	got, err := s.GetAuthCode(ctx, a1.ID)
 	if err != nil {
 		t.Fatalf("failed to get auth code: %v", err)
 	}
@@ -246,15 +246,15 @@ func testAuthCodeCRUD(t *testing.T, s storage.Storage) {
 		t.Errorf("auth code retrieved from storage did not match: %s", diff)
 	}
 
-	if err := s.DeleteAuthCode(a1.ID); err != nil {
+	if err := s.DeleteAuthCode(ctx, a1.ID); err != nil {
 		t.Fatalf("delete auth code: %v", err)
 	}
 
-	if err := s.DeleteAuthCode(a2.ID); err != nil {
+	if err := s.DeleteAuthCode(ctx, a2.ID); err != nil {
 		t.Fatalf("delete auth code: %v", err)
 	}
 
-	_, err = s.GetAuthCode(a1.ID)
+	_, err = s.GetAuthCode(ctx, a1.ID)
 	mustBeErrNotFound(t, "auth code", err)
 }
 
@@ -268,7 +268,7 @@ func testClientCRUD(t *testing.T, s storage.Storage) {
 		Name:         "dex client",
 		LogoURL:      "https://goo.gl/JIyzIC",
 	}
-	err := s.DeleteClient(id1)
+	err := s.DeleteClient(ctx, id1)
 	mustBeErrNotFound(t, "client", err)
 
 	if err := s.CreateClient(ctx, c1); err != nil {
@@ -293,7 +293,7 @@ func testClientCRUD(t *testing.T, s storage.Storage) {
 	}
 
 	getAndCompare := func(_ string, want storage.Client) {
-		gc, err := s.GetClient(id1)
+		gc, err := s.GetClient(ctx, id1)
 		if err != nil {
 			t.Errorf("get client: %v", err)
 			return
@@ -306,7 +306,7 @@ func testClientCRUD(t *testing.T, s storage.Storage) {
 	getAndCompare(id1, c1)
 
 	newSecret := "barfoo"
-	err = s.UpdateClient(id1, func(old storage.Client) (storage.Client, error) {
+	err = s.UpdateClient(ctx, id1, func(old storage.Client) (storage.Client, error) {
 		old.Secret = newSecret
 		return old, nil
 	})
@@ -316,15 +316,15 @@ func testClientCRUD(t *testing.T, s storage.Storage) {
 	c1.Secret = newSecret
 	getAndCompare(id1, c1)
 
-	if err := s.DeleteClient(id1); err != nil {
+	if err := s.DeleteClient(ctx, id1); err != nil {
 		t.Fatalf("delete client: %v", err)
 	}
 
-	if err := s.DeleteClient(id2); err != nil {
+	if err := s.DeleteClient(ctx, id2); err != nil {
 		t.Fatalf("delete client: %v", err)
 	}
 
-	_, err = s.GetClient(id1)
+	_, err = s.GetClient(ctx, id1)
 	mustBeErrNotFound(t, "client", err)
 }
 
@@ -359,7 +359,7 @@ func testRefreshTokenCRUD(t *testing.T, s storage.Storage) {
 	mustBeErrAlreadyExists(t, "refresh token", err)
 
 	getAndCompare := func(id string, want storage.RefreshToken) {
-		gr, err := s.GetRefresh(id)
+		gr, err := s.GetRefresh(ctx, id)
 		if err != nil {
 			t.Errorf("get refresh: %v", err)
 			return
@@ -419,7 +419,7 @@ func testRefreshTokenCRUD(t *testing.T, s storage.Storage) {
 		r.LastUsed = updatedAt
 		return r, nil
 	}
-	if err := s.UpdateRefreshToken(id, updater); err != nil {
+	if err := s.UpdateRefreshToken(ctx, id, updater); err != nil {
 		t.Errorf("failed to update refresh token: %v", err)
 	}
 	refresh.Token = "spam"
@@ -429,15 +429,15 @@ func testRefreshTokenCRUD(t *testing.T, s storage.Storage) {
 	// Ensure that updating the first token doesn't impact the second. Issue #847.
 	getAndCompare(id2, refresh2)
 
-	if err := s.DeleteRefresh(id); err != nil {
+	if err := s.DeleteRefresh(ctx, id); err != nil {
 		t.Fatalf("failed to delete refresh request: %v", err)
 	}
 
-	if err := s.DeleteRefresh(id2); err != nil {
+	if err := s.DeleteRefresh(ctx, id2); err != nil {
 		t.Fatalf("failed to delete refresh request: %v", err)
 	}
 
-	_, err = s.GetRefresh(id)
+	_, err = s.GetRefresh(ctx, id)
 	mustBeErrNotFound(t, "refresh token", err)
 }
 
@@ -485,7 +485,7 @@ func testPasswordCRUD(t *testing.T, s storage.Storage) {
 	}
 
 	getAndCompare := func(id string, want storage.Password) {
-		gr, err := s.GetPassword(id)
+		gr, err := s.GetPassword(ctx, id)
 		if err != nil {
 			t.Errorf("get password %q: %v", id, err)
 			return
@@ -498,7 +498,7 @@ func testPasswordCRUD(t *testing.T, s storage.Storage) {
 	getAndCompare("jane@example.com", password1)
 	getAndCompare("JANE@example.com", password1) // Emails should be case insensitive
 
-	if err := s.UpdatePassword(password1.Email, func(old storage.Password) (storage.Password, error) {
+	if err := s.UpdatePassword(ctx, password1.Email, func(old storage.Password) (storage.Password, error) {
 		old.Username = "jane doe"
 		return old, nil
 	}); err != nil {
@@ -512,7 +512,7 @@ func testPasswordCRUD(t *testing.T, s storage.Storage) {
 	passwordList = append(passwordList, password1, password2)
 
 	listAndCompare := func(want []storage.Password) {
-		passwords, err := s.ListPasswords()
+		passwords, err := s.ListPasswords(ctx)
 		if err != nil {
 			t.Errorf("list password: %v", err)
 			return
@@ -526,15 +526,15 @@ func testPasswordCRUD(t *testing.T, s storage.Storage) {
 
 	listAndCompare(passwordList)
 
-	if err := s.DeletePassword(password1.Email); err != nil {
+	if err := s.DeletePassword(ctx, password1.Email); err != nil {
 		t.Fatalf("failed to delete password: %v", err)
 	}
 
-	if err := s.DeletePassword(password2.Email); err != nil {
+	if err := s.DeletePassword(ctx, password2.Email); err != nil {
 		t.Fatalf("failed to delete password: %v", err)
 	}
 
-	_, err = s.GetPassword(password1.Email)
+	_, err = s.GetPassword(ctx, password1.Email)
 	mustBeErrNotFound(t, "password", err)
 }
 
@@ -571,7 +571,7 @@ func testOfflineSessionCRUD(t *testing.T, s storage.Storage) {
 	}
 
 	getAndCompare := func(userID string, connID string, want storage.OfflineSessions) {
-		gr, err := s.GetOfflineSessions(userID, connID)
+		gr, err := s.GetOfflineSessions(ctx, userID, connID)
 		if err != nil {
 			t.Errorf("get offline session: %v", err)
 			return
@@ -592,7 +592,7 @@ func testOfflineSessionCRUD(t *testing.T, s storage.Storage) {
 	}
 	session1.Refresh[tokenRef.ClientID] = &tokenRef
 
-	if err := s.UpdateOfflineSessions(session1.UserID, session1.ConnID, func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
+	if err := s.UpdateOfflineSessions(ctx, session1.UserID, session1.ConnID, func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
 		old.Refresh[tokenRef.ClientID] = &tokenRef
 		return old, nil
 	}); err != nil {
@@ -601,15 +601,15 @@ func testOfflineSessionCRUD(t *testing.T, s storage.Storage) {
 
 	getAndCompare(userID1, "Conn1", session1)
 
-	if err := s.DeleteOfflineSessions(session1.UserID, session1.ConnID); err != nil {
+	if err := s.DeleteOfflineSessions(ctx, session1.UserID, session1.ConnID); err != nil {
 		t.Fatalf("failed to delete offline session: %v", err)
 	}
 
-	if err := s.DeleteOfflineSessions(session2.UserID, session2.ConnID); err != nil {
+	if err := s.DeleteOfflineSessions(ctx, session2.UserID, session2.ConnID); err != nil {
 		t.Fatalf("failed to delete offline session: %v", err)
 	}
 
-	_, err = s.GetOfflineSessions(session1.UserID, session1.ConnID)
+	_, err = s.GetOfflineSessions(ctx, session1.UserID, session1.ConnID)
 	mustBeErrNotFound(t, "offline session", err)
 }
 
@@ -646,7 +646,7 @@ func testConnectorCRUD(t *testing.T, s storage.Storage) {
 	}
 
 	getAndCompare := func(id string, want storage.Connector) {
-		gr, err := s.GetConnector(id)
+		gr, err := s.GetConnector(ctx, id)
 		if err != nil {
 			t.Errorf("get connector: %v", err)
 			return
@@ -660,7 +660,7 @@ func testConnectorCRUD(t *testing.T, s storage.Storage) {
 
 	getAndCompare(id1, c1)
 
-	if err := s.UpdateConnector(c1.ID, func(old storage.Connector) (storage.Connector, error) {
+	if err := s.UpdateConnector(ctx, c1.ID, func(old storage.Connector) (storage.Connector, error) {
 		old.Type = "oidc"
 		return old, nil
 	}); err != nil {
@@ -672,7 +672,7 @@ func testConnectorCRUD(t *testing.T, s storage.Storage) {
 
 	connectorList := []storage.Connector{c1, c2}
 	listAndCompare := func(want []storage.Connector) {
-		connectors, err := s.ListConnectors()
+		connectors, err := s.ListConnectors(ctx)
 		if err != nil {
 			t.Errorf("list connectors: %v", err)
 			return
@@ -690,21 +690,23 @@ func testConnectorCRUD(t *testing.T, s storage.Storage) {
 	}
 	listAndCompare(connectorList)
 
-	if err := s.DeleteConnector(c1.ID); err != nil {
+	if err := s.DeleteConnector(ctx, c1.ID); err != nil {
 		t.Fatalf("failed to delete connector: %v", err)
 	}
 
-	if err := s.DeleteConnector(c2.ID); err != nil {
+	if err := s.DeleteConnector(ctx, c2.ID); err != nil {
 		t.Fatalf("failed to delete connector: %v", err)
 	}
 
-	_, err = s.GetConnector(c1.ID)
+	_, err = s.GetConnector(ctx, c1.ID)
 	mustBeErrNotFound(t, "connector", err)
 }
 
 func testKeysCRUD(t *testing.T, s storage.Storage) {
+	ctx := context.TODO()
+
 	updateAndCompare := func(k storage.Keys) {
-		err := s.UpdateKeys(func(oldKeys storage.Keys) (storage.Keys, error) {
+		err := s.UpdateKeys(ctx, func(oldKeys storage.Keys) (storage.Keys, error) {
 			return k, nil
 		})
 		if err != nil {
@@ -712,7 +714,7 @@ func testKeysCRUD(t *testing.T, s storage.Storage) {
 			return
 		}
 
-		if got, err := s.GetKeys(); err != nil {
+		if got, err := s.GetKeys(ctx); err != nil {
 			t.Errorf("failed to get keys: %v", err)
 		} else {
 			got.NextRotation = got.NextRotation.UTC()
@@ -786,24 +788,24 @@ func testGC(t *testing.T, s storage.Storage) {
 	}
 
 	for _, tz := range []*time.Location{time.UTC, est, pst} {
-		result, err := s.GarbageCollect(expiry.Add(-time.Hour).In(tz))
+		result, err := s.GarbageCollect(ctx, expiry.Add(-time.Hour).In(tz))
 		if err != nil {
 			t.Errorf("garbage collection failed: %v", err)
 		} else if result.AuthCodes != 0 || result.AuthRequests != 0 {
 			t.Errorf("expected no garbage collection results, got %#v", result)
 		}
-		if _, err := s.GetAuthCode(c.ID); err != nil {
+		if _, err := s.GetAuthCode(ctx, c.ID); err != nil {
 			t.Errorf("expected to be able to get auth code after GC: %v", err)
 		}
 	}
 
-	if r, err := s.GarbageCollect(expiry.Add(time.Hour)); err != nil {
+	if r, err := s.GarbageCollect(ctx, expiry.Add(time.Hour)); err != nil {
 		t.Errorf("garbage collection failed: %v", err)
 	} else if r.AuthCodes != 1 {
 		t.Errorf("expected to garbage collect 1 objects, got %d", r.AuthCodes)
 	}
 
-	if _, err := s.GetAuthCode(c.ID); err == nil {
+	if _, err := s.GetAuthCode(ctx, c.ID); err == nil {
 		t.Errorf("expected auth code to be GC'd")
 	} else if err != storage.ErrNotFound {
 		t.Errorf("expected storage.ErrNotFound, got %v", err)
@@ -837,24 +839,24 @@ func testGC(t *testing.T, s storage.Storage) {
 	}
 
 	for _, tz := range []*time.Location{time.UTC, est, pst} {
-		result, err := s.GarbageCollect(expiry.Add(-time.Hour).In(tz))
+		result, err := s.GarbageCollect(ctx, expiry.Add(-time.Hour).In(tz))
 		if err != nil {
 			t.Errorf("garbage collection failed: %v", err)
 		} else if result.AuthCodes != 0 || result.AuthRequests != 0 {
 			t.Errorf("expected no garbage collection results, got %#v", result)
 		}
-		if _, err := s.GetAuthRequest(a.ID); err != nil {
+		if _, err := s.GetAuthRequest(ctx, a.ID); err != nil {
 			t.Errorf("expected to be able to get auth request after GC: %v", err)
 		}
 	}
 
-	if r, err := s.GarbageCollect(expiry.Add(time.Hour)); err != nil {
+	if r, err := s.GarbageCollect(ctx, expiry.Add(time.Hour)); err != nil {
 		t.Errorf("garbage collection failed: %v", err)
 	} else if r.AuthRequests != 1 {
 		t.Errorf("expected to garbage collect 1 objects, got %d", r.AuthRequests)
 	}
 
-	if _, err := s.GetAuthRequest(a.ID); err == nil {
+	if _, err := s.GetAuthRequest(ctx, a.ID); err == nil {
 		t.Errorf("expected auth request to be GC'd")
 	} else if err != storage.ErrNotFound {
 		t.Errorf("expected storage.ErrNotFound, got %v", err)
@@ -874,23 +876,23 @@ func testGC(t *testing.T, s storage.Storage) {
 	}
 
 	for _, tz := range []*time.Location{time.UTC, est, pst} {
-		result, err := s.GarbageCollect(expiry.Add(-time.Hour).In(tz))
+		result, err := s.GarbageCollect(ctx, expiry.Add(-time.Hour).In(tz))
 		if err != nil {
 			t.Errorf("garbage collection failed: %v", err)
 		} else if result.DeviceRequests != 0 {
 			t.Errorf("expected no device garbage collection results, got %#v", result)
 		}
-		if _, err := s.GetDeviceRequest(d.UserCode); err != nil {
+		if _, err := s.GetDeviceRequest(ctx, d.UserCode); err != nil {
 			t.Errorf("expected to be able to get auth request after GC: %v", err)
 		}
 	}
-	if r, err := s.GarbageCollect(expiry.Add(time.Hour)); err != nil {
+	if r, err := s.GarbageCollect(ctx, expiry.Add(time.Hour)); err != nil {
 		t.Errorf("garbage collection failed: %v", err)
 	} else if r.DeviceRequests != 1 {
 		t.Errorf("expected to garbage collect 1 device request, got %d", r.DeviceRequests)
 	}
 
-	if _, err := s.GetDeviceRequest(d.UserCode); err == nil {
+	if _, err := s.GetDeviceRequest(ctx, d.UserCode); err == nil {
 		t.Errorf("expected device request to be GC'd")
 	} else if err != storage.ErrNotFound {
 		t.Errorf("expected storage.ErrNotFound, got %v", err)
@@ -914,23 +916,23 @@ func testGC(t *testing.T, s storage.Storage) {
 	}
 
 	for _, tz := range []*time.Location{time.UTC, est, pst} {
-		result, err := s.GarbageCollect(expiry.Add(-time.Hour).In(tz))
+		result, err := s.GarbageCollect(ctx, expiry.Add(-time.Hour).In(tz))
 		if err != nil {
 			t.Errorf("garbage collection failed: %v", err)
 		} else if result.DeviceTokens != 0 {
 			t.Errorf("expected no device token garbage collection results, got %#v", result)
 		}
-		if _, err := s.GetDeviceToken(dt.DeviceCode); err != nil {
+		if _, err := s.GetDeviceToken(ctx, dt.DeviceCode); err != nil {
 			t.Errorf("expected to be able to get device token after GC: %v", err)
 		}
 	}
-	if r, err := s.GarbageCollect(expiry.Add(time.Hour)); err != nil {
+	if r, err := s.GarbageCollect(ctx, expiry.Add(time.Hour)); err != nil {
 		t.Errorf("garbage collection failed: %v", err)
 	} else if r.DeviceTokens != 1 {
 		t.Errorf("expected to garbage collect 1 device token, got %d", r.DeviceTokens)
 	}
 
-	if _, err := s.GetDeviceToken(dt.DeviceCode); err == nil {
+	if _, err := s.GetDeviceToken(ctx, dt.DeviceCode); err == nil {
 		t.Errorf("expected device token to be GC'd")
 	} else if err != storage.ErrNotFound {
 		t.Errorf("expected storage.ErrNotFound, got %v", err)
@@ -969,7 +971,7 @@ func testTimezones(t *testing.T, s storage.Storage) {
 	if err := s.CreateAuthCode(ctx, c); err != nil {
 		t.Fatalf("failed creating auth code: %v", err)
 	}
-	got, err := s.GetAuthCode(c.ID)
+	got, err := s.GetAuthCode(ctx, c.ID)
 	if err != nil {
 		t.Fatalf("failed to get auth code: %v", err)
 	}
@@ -1003,7 +1005,7 @@ func testDeviceRequestCRUD(t *testing.T, s storage.Storage) {
 	err := s.CreateDeviceRequest(ctx, d1)
 	mustBeErrAlreadyExists(t, "device request", err)
 
-	got, err := s.GetDeviceRequest(d1.UserCode)
+	got, err := s.GetDeviceRequest(ctx, d1.UserCode)
 	if err != nil {
 		t.Fatalf("failed to get device request: %v", err)
 	}
@@ -1041,7 +1043,7 @@ func testDeviceTokenCRUD(t *testing.T, s storage.Storage) {
 	mustBeErrAlreadyExists(t, "device token", err)
 
 	// Update the device token, simulate a redemption
-	if err := s.UpdateDeviceToken(d1.DeviceCode, func(old storage.DeviceToken) (storage.DeviceToken, error) {
+	if err := s.UpdateDeviceToken(ctx, d1.DeviceCode, func(old storage.DeviceToken) (storage.DeviceToken, error) {
 		old.Token = "token data"
 		old.Status = "complete"
 		return old, nil
@@ -1050,7 +1052,7 @@ func testDeviceTokenCRUD(t *testing.T, s storage.Storage) {
 	}
 
 	// Retrieve the device token
-	got, err := s.GetDeviceToken(d1.DeviceCode)
+	got, err := s.GetDeviceToken(ctx, d1.DeviceCode)
 	if err != nil {
 		t.Fatalf("failed to get device token: %v", err)
 	}
diff --git a/storage/conformance/transactions.go b/storage/conformance/transactions.go
index 69ed5517..60365c9a 100644
--- a/storage/conformance/transactions.go
+++ b/storage/conformance/transactions.go
@@ -42,9 +42,9 @@ func testClientConcurrentUpdate(t *testing.T, s storage.Storage) {
 
 	var err1, err2 error
 
-	err1 = s.UpdateClient(c.ID, func(old storage.Client) (storage.Client, error) {
+	err1 = s.UpdateClient(ctx, c.ID, func(old storage.Client) (storage.Client, error) {
 		old.Secret = "new secret 1"
-		err2 = s.UpdateClient(c.ID, func(old storage.Client) (storage.Client, error) {
+		err2 = s.UpdateClient(ctx, c.ID, func(old storage.Client) (storage.Client, error) {
 			old.Secret = "new secret 2"
 			return old, nil
 		})
@@ -87,9 +87,9 @@ func testAuthRequestConcurrentUpdate(t *testing.T, s storage.Storage) {
 
 	var err1, err2 error
 
-	err1 = s.UpdateAuthRequest(a.ID, func(old storage.AuthRequest) (storage.AuthRequest, error) {
+	err1 = s.UpdateAuthRequest(ctx, a.ID, func(old storage.AuthRequest) (storage.AuthRequest, error) {
 		old.State = "state 1"
-		err2 = s.UpdateAuthRequest(a.ID, func(old storage.AuthRequest) (storage.AuthRequest, error) {
+		err2 = s.UpdateAuthRequest(ctx, a.ID, func(old storage.AuthRequest) (storage.AuthRequest, error) {
 			old.State = "state 2"
 			return old, nil
 		})
@@ -121,9 +121,9 @@ func testPasswordConcurrentUpdate(t *testing.T, s storage.Storage) {
 
 	var err1, err2 error
 
-	err1 = s.UpdatePassword(password.Email, func(old storage.Password) (storage.Password, error) {
+	err1 = s.UpdatePassword(ctx, password.Email, func(old storage.Password) (storage.Password, error) {
 		old.Username = "user 1"
-		err2 = s.UpdatePassword(password.Email, func(old storage.Password) (storage.Password, error) {
+		err2 = s.UpdatePassword(ctx, password.Email, func(old storage.Password) (storage.Password, error) {
 			old.Username = "user 2"
 			return old, nil
 		})
@@ -163,8 +163,9 @@ func testKeysConcurrentUpdate(t *testing.T, s storage.Storage) {
 
 		var err1, err2 error
 
-		err1 = s.UpdateKeys(func(old storage.Keys) (storage.Keys, error) {
-			err2 = s.UpdateKeys(func(old storage.Keys) (storage.Keys, error) {
+		ctx := context.TODO()
+		err1 = s.UpdateKeys(ctx, func(old storage.Keys) (storage.Keys, error) {
+			err2 = s.UpdateKeys(ctx, func(old storage.Keys) (storage.Keys, error) {
 				return keys1, nil
 			})
 			return keys2, nil
diff --git a/storage/ent/client/authcode.go b/storage/ent/client/authcode.go
index 8ac12314..aa5bd184 100644
--- a/storage/ent/client/authcode.go
+++ b/storage/ent/client/authcode.go
@@ -34,8 +34,8 @@ func (d *Database) CreateAuthCode(ctx context.Context, code storage.AuthCode) er
 }
 
 // GetAuthCode extracts an auth code from the database by id.
-func (d *Database) GetAuthCode(id string) (storage.AuthCode, error) {
-	authCode, err := d.client.AuthCode.Get(context.TODO(), id)
+func (d *Database) GetAuthCode(ctx context.Context, id string) (storage.AuthCode, error) {
+	authCode, err := d.client.AuthCode.Get(ctx, id)
 	if err != nil {
 		return storage.AuthCode{}, convertDBError("get auth code: %w", err)
 	}
@@ -43,8 +43,8 @@ func (d *Database) GetAuthCode(id string) (storage.AuthCode, error) {
 }
 
 // DeleteAuthCode deletes an auth code from the database by id.
-func (d *Database) DeleteAuthCode(id string) error {
-	err := d.client.AuthCode.DeleteOneID(id).Exec(context.TODO())
+func (d *Database) DeleteAuthCode(ctx context.Context, id string) error {
+	err := d.client.AuthCode.DeleteOneID(id).Exec(ctx)
 	if err != nil {
 		return convertDBError("delete auth code: %w", err)
 	}
diff --git a/storage/ent/client/authrequest.go b/storage/ent/client/authrequest.go
index 42db702d..25d3e415 100644
--- a/storage/ent/client/authrequest.go
+++ b/storage/ent/client/authrequest.go
@@ -40,8 +40,8 @@ func (d *Database) CreateAuthRequest(ctx context.Context, authRequest storage.Au
 }
 
 // GetAuthRequest extracts an auth request from the database by id.
-func (d *Database) GetAuthRequest(id string) (storage.AuthRequest, error) {
-	authRequest, err := d.client.AuthRequest.Get(context.TODO(), id)
+func (d *Database) GetAuthRequest(ctx context.Context, id string) (storage.AuthRequest, error) {
+	authRequest, err := d.client.AuthRequest.Get(ctx, id)
 	if err != nil {
 		return storage.AuthRequest{}, convertDBError("get auth request: %w", err)
 	}
@@ -49,8 +49,8 @@ func (d *Database) GetAuthRequest(id string) (storage.AuthRequest, error) {
 }
 
 // DeleteAuthRequest deletes an auth request from the database by id.
-func (d *Database) DeleteAuthRequest(id string) error {
-	err := d.client.AuthRequest.DeleteOneID(id).Exec(context.TODO())
+func (d *Database) DeleteAuthRequest(ctx context.Context, id string) error {
+	err := d.client.AuthRequest.DeleteOneID(id).Exec(ctx)
 	if err != nil {
 		return convertDBError("delete auth request: %w", err)
 	}
@@ -58,8 +58,8 @@ func (d *Database) DeleteAuthRequest(id string) error {
 }
 
 // UpdateAuthRequest changes an auth request by id using an updater function and saves it to the database.
-func (d *Database) UpdateAuthRequest(id string, updater func(old storage.AuthRequest) (storage.AuthRequest, error)) error {
-	tx, err := d.BeginTx(context.TODO())
+func (d *Database) UpdateAuthRequest(ctx context.Context, id string, updater func(old storage.AuthRequest) (storage.AuthRequest, error)) error {
+	tx, err := d.BeginTx(ctx)
 	if err != nil {
 		return fmt.Errorf("update auth request tx: %w", err)
 	}
diff --git a/storage/ent/client/client.go b/storage/ent/client/client.go
index 4cb02c0c..1957a76a 100644
--- a/storage/ent/client/client.go
+++ b/storage/ent/client/client.go
@@ -24,8 +24,8 @@ func (d *Database) CreateClient(ctx context.Context, client storage.Client) erro
 }
 
 // ListClients extracts an array of oauth2 clients from the database.
-func (d *Database) ListClients() ([]storage.Client, error) {
-	clients, err := d.client.OAuth2Client.Query().All(context.TODO())
+func (d *Database) ListClients(ctx context.Context) ([]storage.Client, error) {
+	clients, err := d.client.OAuth2Client.Query().All(ctx)
 	if err != nil {
 		return nil, convertDBError("list clients: %w", err)
 	}
@@ -38,8 +38,8 @@ func (d *Database) ListClients() ([]storage.Client, error) {
 }
 
 // GetClient extracts an oauth2 client from the database by id.
-func (d *Database) GetClient(id string) (storage.Client, error) {
-	client, err := d.client.OAuth2Client.Get(context.TODO(), id)
+func (d *Database) GetClient(ctx context.Context, id string) (storage.Client, error) {
+	client, err := d.client.OAuth2Client.Get(ctx, id)
 	if err != nil {
 		return storage.Client{}, convertDBError("get client: %w", err)
 	}
@@ -47,8 +47,8 @@ func (d *Database) GetClient(id string) (storage.Client, error) {
 }
 
 // DeleteClient deletes an oauth2 client from the database by id.
-func (d *Database) DeleteClient(id string) error {
-	err := d.client.OAuth2Client.DeleteOneID(id).Exec(context.TODO())
+func (d *Database) DeleteClient(ctx context.Context, id string) error {
+	err := d.client.OAuth2Client.DeleteOneID(id).Exec(ctx)
 	if err != nil {
 		return convertDBError("delete client: %w", err)
 	}
@@ -56,13 +56,13 @@ func (d *Database) DeleteClient(id string) error {
 }
 
 // UpdateClient changes an oauth2 client by id using an updater function and saves it to the database.
-func (d *Database) UpdateClient(id string, updater func(old storage.Client) (storage.Client, error)) error {
-	tx, err := d.BeginTx(context.TODO())
+func (d *Database) UpdateClient(ctx context.Context, id string, updater func(old storage.Client) (storage.Client, error)) error {
+	tx, err := d.BeginTx(ctx)
 	if err != nil {
 		return convertDBError("update client tx: %w", err)
 	}
 
-	client, err := tx.OAuth2Client.Get(context.TODO(), id)
+	client, err := tx.OAuth2Client.Get(ctx, id)
 	if err != nil {
 		return rollback(tx, "update client database: %w", err)
 	}
@@ -79,7 +79,7 @@ func (d *Database) UpdateClient(id string, updater func(old storage.Client) (sto
 		SetLogoURL(newClient.LogoURL).
 		SetRedirectUris(newClient.RedirectURIs).
 		SetTrustedPeers(newClient.TrustedPeers).
-		Save(context.TODO())
+		Save(ctx)
 	if err != nil {
 		return rollback(tx, "update client uploading: %w", err)
 	}
diff --git a/storage/ent/client/connector.go b/storage/ent/client/connector.go
index 1534e522..f0cff8ba 100644
--- a/storage/ent/client/connector.go
+++ b/storage/ent/client/connector.go
@@ -22,8 +22,8 @@ func (d *Database) CreateConnector(ctx context.Context, connector storage.Connec
 }
 
 // ListConnectors extracts an array of connectors from the database.
-func (d *Database) ListConnectors() ([]storage.Connector, error) {
-	connectors, err := d.client.Connector.Query().All(context.TODO())
+func (d *Database) ListConnectors(ctx context.Context) ([]storage.Connector, error) {
+	connectors, err := d.client.Connector.Query().All(ctx)
 	if err != nil {
 		return nil, convertDBError("list connectors: %w", err)
 	}
@@ -36,8 +36,8 @@ func (d *Database) ListConnectors() ([]storage.Connector, error) {
 }
 
 // GetConnector extracts a connector from the database by id.
-func (d *Database) GetConnector(id string) (storage.Connector, error) {
-	connector, err := d.client.Connector.Get(context.TODO(), id)
+func (d *Database) GetConnector(ctx context.Context, id string) (storage.Connector, error) {
+	connector, err := d.client.Connector.Get(ctx, id)
 	if err != nil {
 		return storage.Connector{}, convertDBError("get connector: %w", err)
 	}
@@ -45,8 +45,8 @@ func (d *Database) GetConnector(id string) (storage.Connector, error) {
 }
 
 // DeleteConnector deletes a connector from the database by id.
-func (d *Database) DeleteConnector(id string) error {
-	err := d.client.Connector.DeleteOneID(id).Exec(context.TODO())
+func (d *Database) DeleteConnector(ctx context.Context, id string) error {
+	err := d.client.Connector.DeleteOneID(id).Exec(ctx)
 	if err != nil {
 		return convertDBError("delete connector: %w", err)
 	}
@@ -54,13 +54,13 @@ func (d *Database) DeleteConnector(id string) error {
 }
 
 // UpdateConnector changes a connector by id using an updater function and saves it to the database.
-func (d *Database) UpdateConnector(id string, updater func(old storage.Connector) (storage.Connector, error)) error {
-	tx, err := d.BeginTx(context.TODO())
+func (d *Database) UpdateConnector(ctx context.Context, id string, updater func(old storage.Connector) (storage.Connector, error)) error {
+	tx, err := d.BeginTx(ctx)
 	if err != nil {
 		return convertDBError("update connector tx: %w", err)
 	}
 
-	connector, err := tx.Connector.Get(context.TODO(), id)
+	connector, err := tx.Connector.Get(ctx, id)
 	if err != nil {
 		return rollback(tx, "update connector database: %w", err)
 	}
@@ -75,7 +75,7 @@ func (d *Database) UpdateConnector(id string, updater func(old storage.Connector
 		SetType(newConnector.Type).
 		SetResourceVersion(newConnector.ResourceVersion).
 		SetConfig(newConnector.Config).
-		Save(context.TODO())
+		Save(ctx)
 	if err != nil {
 		return rollback(tx, "update connector uploading: %w", err)
 	}
diff --git a/storage/ent/client/devicerequest.go b/storage/ent/client/devicerequest.go
index d8d371c9..56733955 100644
--- a/storage/ent/client/devicerequest.go
+++ b/storage/ent/client/devicerequest.go
@@ -25,10 +25,10 @@ func (d *Database) CreateDeviceRequest(ctx context.Context, request storage.Devi
 }
 
 // GetDeviceRequest extracts a device request from the database by user code.
-func (d *Database) GetDeviceRequest(userCode string) (storage.DeviceRequest, error) {
+func (d *Database) GetDeviceRequest(ctx context.Context, userCode string) (storage.DeviceRequest, error) {
 	deviceRequest, err := d.client.DeviceRequest.Query().
 		Where(devicerequest.UserCode(userCode)).
-		Only(context.TODO())
+		Only(ctx)
 	if err != nil {
 		return storage.DeviceRequest{}, convertDBError("get device request: %w", err)
 	}
diff --git a/storage/ent/client/devicetoken.go b/storage/ent/client/devicetoken.go
index 18d483b9..759812b1 100644
--- a/storage/ent/client/devicetoken.go
+++ b/storage/ent/client/devicetoken.go
@@ -27,10 +27,10 @@ func (d *Database) CreateDeviceToken(ctx context.Context, token storage.DeviceTo
 }
 
 // GetDeviceToken extracts a token from the database by device code.
-func (d *Database) GetDeviceToken(deviceCode string) (storage.DeviceToken, error) {
+func (d *Database) GetDeviceToken(ctx context.Context, deviceCode string) (storage.DeviceToken, error) {
 	deviceToken, err := d.client.DeviceToken.Query().
 		Where(devicetoken.DeviceCode(deviceCode)).
-		Only(context.TODO())
+		Only(ctx)
 	if err != nil {
 		return storage.DeviceToken{}, convertDBError("get device token: %w", err)
 	}
@@ -38,15 +38,15 @@ func (d *Database) GetDeviceToken(deviceCode string) (storage.DeviceToken, error
 }
 
 // UpdateDeviceToken changes a token by device code using an updater function and saves it to the database.
-func (d *Database) UpdateDeviceToken(deviceCode string, updater func(old storage.DeviceToken) (storage.DeviceToken, error)) error {
-	tx, err := d.BeginTx(context.TODO())
+func (d *Database) UpdateDeviceToken(ctx context.Context, deviceCode string, updater func(old storage.DeviceToken) (storage.DeviceToken, error)) error {
+	tx, err := d.BeginTx(ctx)
 	if err != nil {
 		return convertDBError("update device token tx: %w", err)
 	}
 
 	token, err := tx.DeviceToken.Query().
 		Where(devicetoken.DeviceCode(deviceCode)).
-		Only(context.TODO())
+		Only(ctx)
 	if err != nil {
 		return rollback(tx, "update device token database: %w", err)
 	}
@@ -67,7 +67,7 @@ func (d *Database) UpdateDeviceToken(deviceCode string, updater func(old storage
 		SetStatus(newToken.Status).
 		SetCodeChallenge(newToken.PKCE.CodeChallenge).
 		SetCodeChallengeMethod(newToken.PKCE.CodeChallengeMethod).
-		Save(context.TODO())
+		Save(ctx)
 	if err != nil {
 		return rollback(tx, "update device token uploading: %w", err)
 	}
diff --git a/storage/ent/client/keys.go b/storage/ent/client/keys.go
index f65d40fc..c4e97202 100644
--- a/storage/ent/client/keys.go
+++ b/storage/ent/client/keys.go
@@ -8,8 +8,8 @@ import (
 	"github.com/dexidp/dex/storage/ent/db"
 )
 
-func getKeys(client *db.KeysClient) (storage.Keys, error) {
-	rawKeys, err := client.Get(context.TODO(), keysRowID)
+func getKeys(ctx context.Context, client *db.KeysClient) (storage.Keys, error) {
+	rawKeys, err := client.Get(ctx, keysRowID)
 	if err != nil {
 		return storage.Keys{}, convertDBError("get keys: %w", err)
 	}
@@ -18,20 +18,20 @@ func getKeys(client *db.KeysClient) (storage.Keys, error) {
 }
 
 // GetKeys returns signing keys, public keys and verification keys from the database.
-func (d *Database) GetKeys() (storage.Keys, error) {
-	return getKeys(d.client.Keys)
+func (d *Database) GetKeys(ctx context.Context) (storage.Keys, error) {
+	return getKeys(ctx, d.client.Keys)
 }
 
 // UpdateKeys rotates keys using updater function.
-func (d *Database) UpdateKeys(updater func(old storage.Keys) (storage.Keys, error)) error {
+func (d *Database) UpdateKeys(ctx context.Context, updater func(old storage.Keys) (storage.Keys, error)) error {
 	firstUpdate := false
 
-	tx, err := d.BeginTx(context.TODO())
+	tx, err := d.BeginTx(ctx)
 	if err != nil {
 		return convertDBError("update keys tx: %w", err)
 	}
 
-	storageKeys, err := getKeys(tx.Keys)
+	storageKeys, err := getKeys(ctx, tx.Keys)
 	if err != nil {
 		if !errors.Is(err, storage.ErrNotFound) {
 			return rollback(tx, "update keys get: %w", err)
@@ -53,7 +53,7 @@ func (d *Database) UpdateKeys(updater func(old storage.Keys) (storage.Keys, erro
 			SetSigningKey(*newKeys.SigningKey).
 			SetSigningKeyPub(*newKeys.SigningKeyPub).
 			SetVerificationKeys(newKeys.VerificationKeys).
-			Save(context.TODO())
+			Save(ctx)
 		if err != nil {
 			return rollback(tx, "create keys: %w", err)
 		}
@@ -68,7 +68,7 @@ func (d *Database) UpdateKeys(updater func(old storage.Keys) (storage.Keys, erro
 		SetSigningKey(*newKeys.SigningKey).
 		SetSigningKeyPub(*newKeys.SigningKeyPub).
 		SetVerificationKeys(newKeys.VerificationKeys).
-		Exec(context.TODO())
+		Exec(ctx)
 	if err != nil {
 		return rollback(tx, "update keys uploading: %w", err)
 	}
diff --git a/storage/ent/client/main.go b/storage/ent/client/main.go
index bc4c1600..a78830fc 100644
--- a/storage/ent/client/main.go
+++ b/storage/ent/client/main.go
@@ -70,13 +70,13 @@ func (d *Database) BeginTx(ctx context.Context) (*db.Tx, error) {
 }
 
 // GarbageCollect removes expired entities from the database.
-func (d *Database) GarbageCollect(now time.Time) (storage.GCResult, error) {
+func (d *Database) GarbageCollect(ctx context.Context, now time.Time) (storage.GCResult, error) {
 	result := storage.GCResult{}
 	utcNow := now.UTC()
 
 	q, err := d.client.AuthRequest.Delete().
 		Where(authrequest.ExpiryLT(utcNow)).
-		Exec(context.TODO())
+		Exec(ctx)
 	if err != nil {
 		return result, convertDBError("gc auth request: %w", err)
 	}
@@ -84,7 +84,7 @@ func (d *Database) GarbageCollect(now time.Time) (storage.GCResult, error) {
 
 	q, err = d.client.AuthCode.Delete().
 		Where(authcode.ExpiryLT(utcNow)).
-		Exec(context.TODO())
+		Exec(ctx)
 	if err != nil {
 		return result, convertDBError("gc auth code: %w", err)
 	}
@@ -92,7 +92,7 @@ func (d *Database) GarbageCollect(now time.Time) (storage.GCResult, error) {
 
 	q, err = d.client.DeviceRequest.Delete().
 		Where(devicerequest.ExpiryLT(utcNow)).
-		Exec(context.TODO())
+		Exec(ctx)
 	if err != nil {
 		return result, convertDBError("gc device request: %w", err)
 	}
@@ -100,7 +100,7 @@ func (d *Database) GarbageCollect(now time.Time) (storage.GCResult, error) {
 
 	q, err = d.client.DeviceToken.Delete().
 		Where(devicetoken.ExpiryLT(utcNow)).
-		Exec(context.TODO())
+		Exec(ctx)
 	if err != nil {
 		return result, convertDBError("gc device token: %w", err)
 	}
diff --git a/storage/ent/client/offlinesession.go b/storage/ent/client/offlinesession.go
index 22469ece..9d608cb6 100644
--- a/storage/ent/client/offlinesession.go
+++ b/storage/ent/client/offlinesession.go
@@ -30,10 +30,10 @@ func (d *Database) CreateOfflineSessions(ctx context.Context, session storage.Of
 }
 
 // GetOfflineSessions extracts an offline session from the database by user id and connector id.
-func (d *Database) GetOfflineSessions(userID, connID string) (storage.OfflineSessions, error) {
+func (d *Database) GetOfflineSessions(ctx context.Context, userID, connID string) (storage.OfflineSessions, error) {
 	id := offlineSessionID(userID, connID, d.hasher)
 
-	offlineSession, err := d.client.OfflineSession.Get(context.TODO(), id)
+	offlineSession, err := d.client.OfflineSession.Get(ctx, id)
 	if err != nil {
 		return storage.OfflineSessions{}, convertDBError("get offline session: %w", err)
 	}
@@ -41,10 +41,10 @@ func (d *Database) GetOfflineSessions(userID, connID string) (storage.OfflineSes
 }
 
 // DeleteOfflineSessions deletes an offline session from the database by user id and connector id.
-func (d *Database) DeleteOfflineSessions(userID, connID string) error {
+func (d *Database) DeleteOfflineSessions(ctx context.Context, userID, connID string) error {
 	id := offlineSessionID(userID, connID, d.hasher)
 
-	err := d.client.OfflineSession.DeleteOneID(id).Exec(context.TODO())
+	err := d.client.OfflineSession.DeleteOneID(id).Exec(ctx)
 	if err != nil {
 		return convertDBError("delete offline session: %w", err)
 	}
@@ -52,15 +52,15 @@ func (d *Database) DeleteOfflineSessions(userID, connID string) error {
 }
 
 // UpdateOfflineSessions changes an offline session by user id and connector id using an updater function.
-func (d *Database) UpdateOfflineSessions(userID string, connID string, updater func(s storage.OfflineSessions) (storage.OfflineSessions, error)) error {
+func (d *Database) UpdateOfflineSessions(ctx context.Context, userID string, connID string, updater func(s storage.OfflineSessions) (storage.OfflineSessions, error)) error {
 	id := offlineSessionID(userID, connID, d.hasher)
 
-	tx, err := d.BeginTx(context.TODO())
+	tx, err := d.BeginTx(ctx)
 	if err != nil {
 		return convertDBError("update offline session tx: %w", err)
 	}
 
-	offlineSession, err := tx.OfflineSession.Get(context.TODO(), id)
+	offlineSession, err := tx.OfflineSession.Get(ctx, id)
 	if err != nil {
 		return rollback(tx, "update offline session database: %w", err)
 	}
@@ -80,7 +80,7 @@ func (d *Database) UpdateOfflineSessions(userID string, connID string, updater f
 		SetConnID(newOfflineSession.ConnID).
 		SetConnectorData(newOfflineSession.ConnectorData).
 		SetRefresh(encodedRefresh).
-		Save(context.TODO())
+		Save(ctx)
 	if err != nil {
 		return rollback(tx, "update offline session uploading: %w", err)
 	}
diff --git a/storage/ent/client/password.go b/storage/ent/client/password.go
index 3e4aace8..2845fa8f 100644
--- a/storage/ent/client/password.go
+++ b/storage/ent/client/password.go
@@ -23,8 +23,8 @@ func (d *Database) CreatePassword(ctx context.Context, password storage.Password
 }
 
 // ListPasswords extracts an array of passwords from the database.
-func (d *Database) ListPasswords() ([]storage.Password, error) {
-	passwords, err := d.client.Password.Query().All(context.TODO())
+func (d *Database) ListPasswords(ctx context.Context) ([]storage.Password, error) {
+	passwords, err := d.client.Password.Query().All(ctx)
 	if err != nil {
 		return nil, convertDBError("list passwords: %w", err)
 	}
@@ -37,11 +37,11 @@ func (d *Database) ListPasswords() ([]storage.Password, error) {
 }
 
 // GetPassword extracts a password from the database by email.
-func (d *Database) GetPassword(email string) (storage.Password, error) {
+func (d *Database) GetPassword(ctx context.Context, email string) (storage.Password, error) {
 	email = strings.ToLower(email)
 	passwordFromStorage, err := d.client.Password.Query().
 		Where(password.Email(email)).
-		Only(context.TODO())
+		Only(ctx)
 	if err != nil {
 		return storage.Password{}, convertDBError("get password: %w", err)
 	}
@@ -49,11 +49,11 @@ func (d *Database) GetPassword(email string) (storage.Password, error) {
 }
 
 // DeletePassword deletes a password from the database by email.
-func (d *Database) DeletePassword(email string) error {
+func (d *Database) DeletePassword(ctx context.Context, email string) error {
 	email = strings.ToLower(email)
 	_, err := d.client.Password.Delete().
 		Where(password.Email(email)).
-		Exec(context.TODO())
+		Exec(ctx)
 	if err != nil {
 		return convertDBError("delete password: %w", err)
 	}
@@ -61,17 +61,17 @@ func (d *Database) DeletePassword(email string) error {
 }
 
 // UpdatePassword changes a password by email using an updater function and saves it to the database.
-func (d *Database) UpdatePassword(email string, updater func(old storage.Password) (storage.Password, error)) error {
+func (d *Database) UpdatePassword(ctx context.Context, email string, updater func(old storage.Password) (storage.Password, error)) error {
 	email = strings.ToLower(email)
 
-	tx, err := d.BeginTx(context.TODO())
+	tx, err := d.BeginTx(ctx)
 	if err != nil {
 		return convertDBError("update connector tx: %w", err)
 	}
 
 	passwordToUpdate, err := tx.Password.Query().
 		Where(password.Email(email)).
-		Only(context.TODO())
+		Only(ctx)
 	if err != nil {
 		return rollback(tx, "update password database: %w", err)
 	}
@@ -87,7 +87,7 @@ func (d *Database) UpdatePassword(email string, updater func(old storage.Passwor
 		SetHash(newPassword.Hash).
 		SetUsername(newPassword.Username).
 		SetUserID(newPassword.UserID).
-		Save(context.TODO())
+		Save(ctx)
 	if err != nil {
 		return rollback(tx, "update password uploading: %w", err)
 	}
diff --git a/storage/ent/client/refreshtoken.go b/storage/ent/client/refreshtoken.go
index 6861b079..d4235654 100644
--- a/storage/ent/client/refreshtoken.go
+++ b/storage/ent/client/refreshtoken.go
@@ -34,8 +34,8 @@ func (d *Database) CreateRefresh(ctx context.Context, refresh storage.RefreshTok
 }
 
 // ListRefreshTokens extracts an array of refresh tokens from the database.
-func (d *Database) ListRefreshTokens() ([]storage.RefreshToken, error) {
-	refreshTokens, err := d.client.RefreshToken.Query().All(context.TODO())
+func (d *Database) ListRefreshTokens(ctx context.Context) ([]storage.RefreshToken, error) {
+	refreshTokens, err := d.client.RefreshToken.Query().All(ctx)
 	if err != nil {
 		return nil, convertDBError("list refresh tokens: %w", err)
 	}
@@ -48,8 +48,8 @@ func (d *Database) ListRefreshTokens() ([]storage.RefreshToken, error) {
 }
 
 // GetRefresh extracts a refresh token from the database by id.
-func (d *Database) GetRefresh(id string) (storage.RefreshToken, error) {
-	refreshToken, err := d.client.RefreshToken.Get(context.TODO(), id)
+func (d *Database) GetRefresh(ctx context.Context, id string) (storage.RefreshToken, error) {
+	refreshToken, err := d.client.RefreshToken.Get(ctx, id)
 	if err != nil {
 		return storage.RefreshToken{}, convertDBError("get refresh token: %w", err)
 	}
@@ -57,8 +57,8 @@ func (d *Database) GetRefresh(id string) (storage.RefreshToken, error) {
 }
 
 // DeleteRefresh deletes a refresh token from the database by id.
-func (d *Database) DeleteRefresh(id string) error {
-	err := d.client.RefreshToken.DeleteOneID(id).Exec(context.TODO())
+func (d *Database) DeleteRefresh(ctx context.Context, id string) error {
+	err := d.client.RefreshToken.DeleteOneID(id).Exec(ctx)
 	if err != nil {
 		return convertDBError("delete refresh token: %w", err)
 	}
@@ -66,13 +66,13 @@ func (d *Database) DeleteRefresh(id string) error {
 }
 
 // UpdateRefreshToken changes a refresh token by id using an updater function and saves it to the database.
-func (d *Database) UpdateRefreshToken(id string, updater func(old storage.RefreshToken) (storage.RefreshToken, error)) error {
-	tx, err := d.BeginTx(context.TODO())
+func (d *Database) UpdateRefreshToken(ctx context.Context, id string, updater func(old storage.RefreshToken) (storage.RefreshToken, error)) error {
+	tx, err := d.BeginTx(ctx)
 	if err != nil {
 		return convertDBError("update refresh token tx: %w", err)
 	}
 
-	token, err := tx.RefreshToken.Get(context.TODO(), id)
+	token, err := tx.RefreshToken.Get(ctx, id)
 	if err != nil {
 		return rollback(tx, "update refresh token database: %w", err)
 	}
@@ -99,7 +99,7 @@ func (d *Database) UpdateRefreshToken(id string, updater func(old storage.Refres
 		// Save utc time into database because ent doesn't support comparing dates with different timezones
 		SetLastUsed(newtToken.LastUsed.UTC()).
 		SetCreatedAt(newtToken.CreatedAt.UTC()).
-		Save(context.TODO())
+		Save(ctx)
 	if err != nil {
 		return rollback(tx, "update refresh token uploading: %w", err)
 	}
diff --git a/storage/etcd/etcd.go b/storage/etcd/etcd.go
index f65701ff..8ccf502f 100644
--- a/storage/etcd/etcd.go
+++ b/storage/etcd/etcd.go
@@ -40,8 +40,8 @@ func (c *conn) Close() error {
 	return c.db.Close()
 }
 
-func (c *conn) GarbageCollect(now time.Time) (result storage.GCResult, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GarbageCollect(ctx context.Context, now time.Time) (result storage.GCResult, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	authRequests, err := c.listAuthRequests(ctx)
 	if err != nil {
@@ -113,8 +113,9 @@ func (c *conn) CreateAuthRequest(ctx context.Context, a storage.AuthRequest) err
 	return c.txnCreate(ctx, keyID(authRequestPrefix, a.ID), fromStorageAuthRequest(a))
 }
 
-func (c *conn) GetAuthRequest(id string) (a storage.AuthRequest, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GetAuthRequest(ctx context.Context, id string) (a storage.AuthRequest, err error) {
+	// TODO: Add this to other funcs??
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	var req AuthRequest
 	if err = c.getKey(ctx, keyID(authRequestPrefix, id), &req); err != nil {
@@ -123,8 +124,8 @@ func (c *conn) GetAuthRequest(id string) (a storage.AuthRequest, err error) {
 	return toStorageAuthRequest(req), nil
 }
 
-func (c *conn) UpdateAuthRequest(id string, updater func(a storage.AuthRequest) (storage.AuthRequest, error)) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) UpdateAuthRequest(ctx context.Context, id string, updater func(a storage.AuthRequest) (storage.AuthRequest, error)) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.txnUpdate(ctx, keyID(authRequestPrefix, id), func(currentValue []byte) ([]byte, error) {
 		var current AuthRequest
@@ -141,8 +142,8 @@ func (c *conn) UpdateAuthRequest(id string, updater func(a storage.AuthRequest)
 	})
 }
 
-func (c *conn) DeleteAuthRequest(id string) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) DeleteAuthRequest(ctx context.Context, id string) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.deleteKey(ctx, keyID(authRequestPrefix, id))
 }
@@ -151,8 +152,8 @@ func (c *conn) CreateAuthCode(ctx context.Context, a storage.AuthCode) error {
 	return c.txnCreate(ctx, keyID(authCodePrefix, a.ID), fromStorageAuthCode(a))
 }
 
-func (c *conn) GetAuthCode(id string) (a storage.AuthCode, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GetAuthCode(ctx context.Context, id string) (a storage.AuthCode, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	var ac AuthCode
 	err = c.getKey(ctx, keyID(authCodePrefix, id), &ac)
@@ -162,8 +163,8 @@ func (c *conn) GetAuthCode(id string) (a storage.AuthCode, err error) {
 	return a, err
 }
 
-func (c *conn) DeleteAuthCode(id string) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) DeleteAuthCode(ctx context.Context, id string) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.deleteKey(ctx, keyID(authCodePrefix, id))
 }
@@ -172,8 +173,8 @@ func (c *conn) CreateRefresh(ctx context.Context, r storage.RefreshToken) error
 	return c.txnCreate(ctx, keyID(refreshTokenPrefix, r.ID), fromStorageRefreshToken(r))
 }
 
-func (c *conn) GetRefresh(id string) (r storage.RefreshToken, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GetRefresh(ctx context.Context, id string) (r storage.RefreshToken, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	var token RefreshToken
 	if err = c.getKey(ctx, keyID(refreshTokenPrefix, id), &token); err != nil {
@@ -182,8 +183,8 @@ func (c *conn) GetRefresh(id string) (r storage.RefreshToken, err error) {
 	return toStorageRefreshToken(token), nil
 }
 
-func (c *conn) UpdateRefreshToken(id string, updater func(old storage.RefreshToken) (storage.RefreshToken, error)) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) UpdateRefreshToken(ctx context.Context, id string, updater func(old storage.RefreshToken) (storage.RefreshToken, error)) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.txnUpdate(ctx, keyID(refreshTokenPrefix, id), func(currentValue []byte) ([]byte, error) {
 		var current RefreshToken
@@ -200,14 +201,14 @@ func (c *conn) UpdateRefreshToken(id string, updater func(old storage.RefreshTok
 	})
 }
 
-func (c *conn) DeleteRefresh(id string) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) DeleteRefresh(ctx context.Context, id string) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.deleteKey(ctx, keyID(refreshTokenPrefix, id))
 }
 
-func (c *conn) ListRefreshTokens() (tokens []storage.RefreshToken, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) ListRefreshTokens(ctx context.Context) (tokens []storage.RefreshToken, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	res, err := c.db.Get(ctx, refreshTokenPrefix, clientv3.WithPrefix())
 	if err != nil {
@@ -227,15 +228,15 @@ func (c *conn) CreateClient(ctx context.Context, cli storage.Client) error {
 	return c.txnCreate(ctx, keyID(clientPrefix, cli.ID), cli)
 }
 
-func (c *conn) GetClient(id string) (cli storage.Client, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GetClient(ctx context.Context, id string) (cli storage.Client, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	err = c.getKey(ctx, keyID(clientPrefix, id), &cli)
 	return cli, err
 }
 
-func (c *conn) UpdateClient(id string, updater func(old storage.Client) (storage.Client, error)) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) UpdateClient(ctx context.Context, id string, updater func(old storage.Client) (storage.Client, error)) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.txnUpdate(ctx, keyID(clientPrefix, id), func(currentValue []byte) ([]byte, error) {
 		var current storage.Client
@@ -252,14 +253,14 @@ func (c *conn) UpdateClient(id string, updater func(old storage.Client) (storage
 	})
 }
 
-func (c *conn) DeleteClient(id string) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) DeleteClient(ctx context.Context, id string) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.deleteKey(ctx, keyID(clientPrefix, id))
 }
 
-func (c *conn) ListClients() (clients []storage.Client, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) ListClients(ctx context.Context) (clients []storage.Client, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	res, err := c.db.Get(ctx, clientPrefix, clientv3.WithPrefix())
 	if err != nil {
@@ -279,15 +280,15 @@ func (c *conn) CreatePassword(ctx context.Context, p storage.Password) error {
 	return c.txnCreate(ctx, passwordPrefix+strings.ToLower(p.Email), p)
 }
 
-func (c *conn) GetPassword(email string) (p storage.Password, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GetPassword(ctx context.Context, email string) (p storage.Password, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	err = c.getKey(ctx, keyEmail(passwordPrefix, email), &p)
 	return p, err
 }
 
-func (c *conn) UpdatePassword(email string, updater func(p storage.Password) (storage.Password, error)) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) UpdatePassword(ctx context.Context, email string, updater func(p storage.Password) (storage.Password, error)) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.txnUpdate(ctx, keyEmail(passwordPrefix, email), func(currentValue []byte) ([]byte, error) {
 		var current storage.Password
@@ -304,14 +305,14 @@ func (c *conn) UpdatePassword(email string, updater func(p storage.Password) (st
 	})
 }
 
-func (c *conn) DeletePassword(email string) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) DeletePassword(ctx context.Context, email string) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.deleteKey(ctx, keyEmail(passwordPrefix, email))
 }
 
-func (c *conn) ListPasswords() (passwords []storage.Password, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) ListPasswords(ctx context.Context) (passwords []storage.Password, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	res, err := c.db.Get(ctx, passwordPrefix, clientv3.WithPrefix())
 	if err != nil {
@@ -331,8 +332,8 @@ func (c *conn) CreateOfflineSessions(ctx context.Context, s storage.OfflineSessi
 	return c.txnCreate(ctx, keySession(s.UserID, s.ConnID), fromStorageOfflineSessions(s))
 }
 
-func (c *conn) UpdateOfflineSessions(userID string, connID string, updater func(s storage.OfflineSessions) (storage.OfflineSessions, error)) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) UpdateOfflineSessions(ctx context.Context, userID string, connID string, updater func(s storage.OfflineSessions) (storage.OfflineSessions, error)) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.txnUpdate(ctx, keySession(userID, connID), func(currentValue []byte) ([]byte, error) {
 		var current OfflineSessions
@@ -349,8 +350,8 @@ func (c *conn) UpdateOfflineSessions(userID string, connID string, updater func(
 	})
 }
 
-func (c *conn) GetOfflineSessions(userID string, connID string) (s storage.OfflineSessions, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GetOfflineSessions(ctx context.Context, userID string, connID string) (s storage.OfflineSessions, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	var os OfflineSessions
 	if err = c.getKey(ctx, keySession(userID, connID), &os); err != nil {
@@ -359,8 +360,8 @@ func (c *conn) GetOfflineSessions(userID string, connID string) (s storage.Offli
 	return toStorageOfflineSessions(os), nil
 }
 
-func (c *conn) DeleteOfflineSessions(userID string, connID string) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) DeleteOfflineSessions(ctx context.Context, userID string, connID string) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.deleteKey(ctx, keySession(userID, connID))
 }
@@ -369,15 +370,15 @@ func (c *conn) CreateConnector(ctx context.Context, connector storage.Connector)
 	return c.txnCreate(ctx, keyID(connectorPrefix, connector.ID), connector)
 }
 
-func (c *conn) GetConnector(id string) (conn storage.Connector, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GetConnector(ctx context.Context, id string) (conn storage.Connector, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	err = c.getKey(ctx, keyID(connectorPrefix, id), &conn)
 	return conn, err
 }
 
-func (c *conn) UpdateConnector(id string, updater func(s storage.Connector) (storage.Connector, error)) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) UpdateConnector(ctx context.Context, id string, updater func(s storage.Connector) (storage.Connector, error)) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.txnUpdate(ctx, keyID(connectorPrefix, id), func(currentValue []byte) ([]byte, error) {
 		var current storage.Connector
@@ -394,14 +395,14 @@ func (c *conn) UpdateConnector(id string, updater func(s storage.Connector) (sto
 	})
 }
 
-func (c *conn) DeleteConnector(id string) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) DeleteConnector(ctx context.Context, id string) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.deleteKey(ctx, keyID(connectorPrefix, id))
 }
 
-func (c *conn) ListConnectors() (connectors []storage.Connector, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) ListConnectors(ctx context.Context) (connectors []storage.Connector, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	res, err := c.db.Get(ctx, connectorPrefix, clientv3.WithPrefix())
 	if err != nil {
@@ -417,8 +418,8 @@ func (c *conn) ListConnectors() (connectors []storage.Connector, err error) {
 	return connectors, nil
 }
 
-func (c *conn) GetKeys() (keys storage.Keys, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GetKeys(ctx context.Context) (keys storage.Keys, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	res, err := c.db.Get(ctx, keysName)
 	if err != nil {
@@ -430,8 +431,8 @@ func (c *conn) GetKeys() (keys storage.Keys, err error) {
 	return keys, err
 }
 
-func (c *conn) UpdateKeys(updater func(old storage.Keys) (storage.Keys, error)) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) UpdateKeys(ctx context.Context, updater func(old storage.Keys) (storage.Keys, error)) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.txnUpdate(ctx, keysName, func(currentValue []byte) ([]byte, error) {
 		var current storage.Keys
@@ -560,8 +561,8 @@ func (c *conn) CreateDeviceRequest(ctx context.Context, d storage.DeviceRequest)
 	return c.txnCreate(ctx, keyID(deviceRequestPrefix, d.UserCode), fromStorageDeviceRequest(d))
 }
 
-func (c *conn) GetDeviceRequest(userCode string) (r storage.DeviceRequest, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GetDeviceRequest(ctx context.Context, userCode string) (r storage.DeviceRequest, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	var dr DeviceRequest
 	if err = c.getKey(ctx, keyID(deviceRequestPrefix, userCode), &dr); err == nil {
@@ -589,8 +590,8 @@ func (c *conn) CreateDeviceToken(ctx context.Context, t storage.DeviceToken) err
 	return c.txnCreate(ctx, keyID(deviceTokenPrefix, t.DeviceCode), fromStorageDeviceToken(t))
 }
 
-func (c *conn) GetDeviceToken(deviceCode string) (t storage.DeviceToken, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GetDeviceToken(ctx context.Context, deviceCode string) (t storage.DeviceToken, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	var dt DeviceToken
 	if err = c.getKey(ctx, keyID(deviceTokenPrefix, deviceCode), &dt); err == nil {
@@ -614,8 +615,8 @@ func (c *conn) listDeviceTokens(ctx context.Context) (deviceTokens []DeviceToken
 	return deviceTokens, nil
 }
 
-func (c *conn) UpdateDeviceToken(deviceCode string, updater func(old storage.DeviceToken) (storage.DeviceToken, error)) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) UpdateDeviceToken(ctx context.Context, deviceCode string, updater func(old storage.DeviceToken) (storage.DeviceToken, error)) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.txnUpdate(ctx, keyID(deviceTokenPrefix, deviceCode), func(currentValue []byte) ([]byte, error) {
 		var current DeviceToken
diff --git a/storage/health.go b/storage/health.go
index 8cdefddf..fe75a2da 100644
--- a/storage/health.go
+++ b/storage/health.go
@@ -23,7 +23,7 @@ func NewCustomHealthCheckFunc(s Storage, now func() time.Time) func(context.Cont
 			return nil, fmt.Errorf("create auth request: %v", err)
 		}
 
-		if err := s.DeleteAuthRequest(a.ID); err != nil {
+		if err := s.DeleteAuthRequest(ctx, a.ID); err != nil {
 			return nil, fmt.Errorf("delete auth request: %v", err)
 		}
 
diff --git a/storage/kubernetes/storage.go b/storage/kubernetes/storage.go
index 8b6d5c9c..6ff52283 100644
--- a/storage/kubernetes/storage.go
+++ b/storage/kubernetes/storage.go
@@ -262,7 +262,7 @@ func (cli *client) CreateConnector(ctx context.Context, c storage.Connector) err
 	return cli.post(resourceConnector, cli.fromStorageConnector(c))
 }
 
-func (cli *client) GetAuthRequest(id string) (storage.AuthRequest, error) {
+func (cli *client) GetAuthRequest(ctx context.Context, id string) (storage.AuthRequest, error) {
 	var req AuthRequest
 	if err := cli.get(resourceAuthRequest, id, &req); err != nil {
 		return storage.AuthRequest{}, err
@@ -270,7 +270,7 @@ func (cli *client) GetAuthRequest(id string) (storage.AuthRequest, error) {
 	return toStorageAuthRequest(req), nil
 }
 
-func (cli *client) GetAuthCode(id string) (storage.AuthCode, error) {
+func (cli *client) GetAuthCode(ctx context.Context, id string) (storage.AuthCode, error) {
 	var code AuthCode
 	if err := cli.get(resourceAuthCode, id, &code); err != nil {
 		return storage.AuthCode{}, err
@@ -278,7 +278,7 @@ func (cli *client) GetAuthCode(id string) (storage.AuthCode, error) {
 	return toStorageAuthCode(code), nil
 }
 
-func (cli *client) GetClient(id string) (storage.Client, error) {
+func (cli *client) GetClient(ctx context.Context, id string) (storage.Client, error) {
 	c, err := cli.getClient(id)
 	if err != nil {
 		return storage.Client{}, err
@@ -298,7 +298,7 @@ func (cli *client) getClient(id string) (Client, error) {
 	return c, nil
 }
 
-func (cli *client) GetPassword(email string) (storage.Password, error) {
+func (cli *client) GetPassword(ctx context.Context, email string) (storage.Password, error) {
 	p, err := cli.getPassword(email)
 	if err != nil {
 		return storage.Password{}, err
@@ -320,7 +320,7 @@ func (cli *client) getPassword(email string) (Password, error) {
 	return p, nil
 }
 
-func (cli *client) GetKeys() (storage.Keys, error) {
+func (cli *client) GetKeys(ctx context.Context) (storage.Keys, error) {
 	var keys Keys
 	if err := cli.get(resourceKeys, keysName, &keys); err != nil {
 		return storage.Keys{}, err
@@ -328,7 +328,7 @@ func (cli *client) GetKeys() (storage.Keys, error) {
 	return toStorageKeys(keys), nil
 }
 
-func (cli *client) GetRefresh(id string) (storage.RefreshToken, error) {
+func (cli *client) GetRefresh(ctx context.Context, id string) (storage.RefreshToken, error) {
 	r, err := cli.getRefreshToken(id)
 	if err != nil {
 		return storage.RefreshToken{}, err
@@ -341,7 +341,7 @@ func (cli *client) getRefreshToken(id string) (r RefreshToken, err error) {
 	return
 }
 
-func (cli *client) GetOfflineSessions(userID string, connID string) (storage.OfflineSessions, error) {
+func (cli *client) GetOfflineSessions(ctx context.Context, userID string, connID string) (storage.OfflineSessions, error) {
 	o, err := cli.getOfflineSessions(userID, connID)
 	if err != nil {
 		return storage.OfflineSessions{}, err
@@ -360,7 +360,7 @@ func (cli *client) getOfflineSessions(userID string, connID string) (o OfflineSe
 	return o, nil
 }
 
-func (cli *client) GetConnector(id string) (storage.Connector, error) {
+func (cli *client) GetConnector(ctx context.Context, id string) (storage.Connector, error) {
 	var c Connector
 	if err := cli.get(resourceConnector, id, &c); err != nil {
 		return storage.Connector{}, err
@@ -368,15 +368,15 @@ func (cli *client) GetConnector(id string) (storage.Connector, error) {
 	return toStorageConnector(c), nil
 }
 
-func (cli *client) ListClients() ([]storage.Client, error) {
+func (cli *client) ListClients(ctx context.Context) ([]storage.Client, error) {
 	return nil, errors.New("not implemented")
 }
 
-func (cli *client) ListRefreshTokens() ([]storage.RefreshToken, error) {
+func (cli *client) ListRefreshTokens(ctx context.Context) ([]storage.RefreshToken, error) {
 	return nil, errors.New("not implemented")
 }
 
-func (cli *client) ListPasswords() (passwords []storage.Password, err error) {
+func (cli *client) ListPasswords(ctx context.Context) (passwords []storage.Password, err error) {
 	var passwordList PasswordList
 	if err = cli.list(resourcePassword, &passwordList); err != nil {
 		return passwords, fmt.Errorf("failed to list passwords: %v", err)
@@ -395,7 +395,7 @@ func (cli *client) ListPasswords() (passwords []storage.Password, err error) {
 	return
 }
 
-func (cli *client) ListConnectors() (connectors []storage.Connector, err error) {
+func (cli *client) ListConnectors(ctx context.Context) (connectors []storage.Connector, err error) {
 	var connectorList ConnectorList
 	if err = cli.list(resourceConnector, &connectorList); err != nil {
 		return connectors, fmt.Errorf("failed to list connectors: %v", err)
@@ -409,15 +409,15 @@ func (cli *client) ListConnectors() (connectors []storage.Connector, err error)
 	return
 }
 
-func (cli *client) DeleteAuthRequest(id string) error {
+func (cli *client) DeleteAuthRequest(ctx context.Context, id string) error {
 	return cli.delete(resourceAuthRequest, id)
 }
 
-func (cli *client) DeleteAuthCode(code string) error {
+func (cli *client) DeleteAuthCode(ctx context.Context, code string) error {
 	return cli.delete(resourceAuthCode, code)
 }
 
-func (cli *client) DeleteClient(id string) error {
+func (cli *client) DeleteClient(ctx context.Context, id string) error {
 	// Check for hash collision.
 	c, err := cli.getClient(id)
 	if err != nil {
@@ -426,11 +426,11 @@ func (cli *client) DeleteClient(id string) error {
 	return cli.delete(resourceClient, c.ObjectMeta.Name)
 }
 
-func (cli *client) DeleteRefresh(id string) error {
+func (cli *client) DeleteRefresh(ctx context.Context, id string) error {
 	return cli.delete(resourceRefreshToken, id)
 }
 
-func (cli *client) DeletePassword(email string) error {
+func (cli *client) DeletePassword(ctx context.Context, email string) error {
 	// Check for hash collision.
 	p, err := cli.getPassword(email)
 	if err != nil {
@@ -439,7 +439,7 @@ func (cli *client) DeletePassword(email string) error {
 	return cli.delete(resourcePassword, p.ObjectMeta.Name)
 }
 
-func (cli *client) DeleteOfflineSessions(userID string, connID string) error {
+func (cli *client) DeleteOfflineSessions(ctx context.Context, userID string, connID string) error {
 	// Check for hash collision.
 	o, err := cli.getOfflineSessions(userID, connID)
 	if err != nil {
@@ -448,11 +448,11 @@ func (cli *client) DeleteOfflineSessions(userID string, connID string) error {
 	return cli.delete(resourceOfflineSessions, o.ObjectMeta.Name)
 }
 
-func (cli *client) DeleteConnector(id string) error {
+func (cli *client) DeleteConnector(ctx context.Context, id string) error {
 	return cli.delete(resourceConnector, id)
 }
 
-func (cli *client) UpdateRefreshToken(id string, updater func(old storage.RefreshToken) (storage.RefreshToken, error)) error {
+func (cli *client) UpdateRefreshToken(ctx context.Context, id string, updater func(old storage.RefreshToken) (storage.RefreshToken, error)) error {
 	lock := newRefreshTokenLock(cli)
 
 	if err := lock.Lock(id); err != nil {
@@ -460,7 +460,7 @@ func (cli *client) UpdateRefreshToken(id string, updater func(old storage.Refres
 	}
 	defer lock.Unlock(id)
 
-	return retryOnConflict(context.TODO(), func() error {
+	return retryOnConflict(ctx, func() error {
 		r, err := cli.getRefreshToken(id)
 		if err != nil {
 			return err
@@ -479,7 +479,7 @@ func (cli *client) UpdateRefreshToken(id string, updater func(old storage.Refres
 	})
 }
 
-func (cli *client) UpdateClient(id string, updater func(old storage.Client) (storage.Client, error)) error {
+func (cli *client) UpdateClient(ctx context.Context, id string, updater func(old storage.Client) (storage.Client, error)) error {
 	c, err := cli.getClient(id)
 	if err != nil {
 		return err
@@ -496,7 +496,7 @@ func (cli *client) UpdateClient(id string, updater func(old storage.Client) (sto
 	return cli.put(resourceClient, c.ObjectMeta.Name, newClient)
 }
 
-func (cli *client) UpdatePassword(email string, updater func(old storage.Password) (storage.Password, error)) error {
+func (cli *client) UpdatePassword(ctx context.Context, email string, updater func(old storage.Password) (storage.Password, error)) error {
 	p, err := cli.getPassword(email)
 	if err != nil {
 		return err
@@ -513,8 +513,8 @@ func (cli *client) UpdatePassword(email string, updater func(old storage.Passwor
 	return cli.put(resourcePassword, p.ObjectMeta.Name, newPassword)
 }
 
-func (cli *client) UpdateOfflineSessions(userID string, connID string, updater func(old storage.OfflineSessions) (storage.OfflineSessions, error)) error {
-	return retryOnConflict(context.TODO(), func() error {
+func (cli *client) UpdateOfflineSessions(ctx context.Context, userID string, connID string, updater func(old storage.OfflineSessions) (storage.OfflineSessions, error)) error {
+	return retryOnConflict(ctx, func() error {
 		o, err := cli.getOfflineSessions(userID, connID)
 		if err != nil {
 			return err
@@ -531,7 +531,7 @@ func (cli *client) UpdateOfflineSessions(userID string, connID string, updater f
 	})
 }
 
-func (cli *client) UpdateKeys(updater func(old storage.Keys) (storage.Keys, error)) error {
+func (cli *client) UpdateKeys(ctx context.Context, updater func(old storage.Keys) (storage.Keys, error)) error {
 	firstUpdate := false
 	var keys Keys
 	if err := cli.get(resourceKeys, keysName, &keys); err != nil {
@@ -576,7 +576,7 @@ func (cli *client) UpdateKeys(updater func(old storage.Keys) (storage.Keys, erro
 	return err
 }
 
-func (cli *client) UpdateAuthRequest(id string, updater func(a storage.AuthRequest) (storage.AuthRequest, error)) error {
+func (cli *client) UpdateAuthRequest(ctx context.Context, id string, updater func(a storage.AuthRequest) (storage.AuthRequest, error)) error {
 	var req AuthRequest
 	err := cli.get(resourceAuthRequest, id, &req)
 	if err != nil {
@@ -593,8 +593,8 @@ func (cli *client) UpdateAuthRequest(id string, updater func(a storage.AuthReque
 	return cli.put(resourceAuthRequest, id, newReq)
 }
 
-func (cli *client) UpdateConnector(id string, updater func(a storage.Connector) (storage.Connector, error)) error {
-	return retryOnConflict(context.TODO(), func() error {
+func (cli *client) UpdateConnector(ctx context.Context, id string, updater func(a storage.Connector) (storage.Connector, error)) error {
+	return retryOnConflict(ctx, func() error {
 		var c Connector
 		err := cli.get(resourceConnector, id, &c)
 		if err != nil {
@@ -612,7 +612,7 @@ func (cli *client) UpdateConnector(id string, updater func(a storage.Connector)
 	})
 }
 
-func (cli *client) GarbageCollect(now time.Time) (result storage.GCResult, err error) {
+func (cli *client) GarbageCollect(ctx context.Context, now time.Time) (result storage.GCResult, err error) {
 	var authRequests AuthRequestList
 	if err := cli.listN(resourceAuthRequest, &authRequests, gcResultLimit); err != nil {
 		return result, fmt.Errorf("failed to list auth requests: %v", err)
@@ -687,7 +687,7 @@ func (cli *client) CreateDeviceRequest(ctx context.Context, d storage.DeviceRequ
 	return cli.post(resourceDeviceRequest, cli.fromStorageDeviceRequest(d))
 }
 
-func (cli *client) GetDeviceRequest(userCode string) (storage.DeviceRequest, error) {
+func (cli *client) GetDeviceRequest(ctx context.Context, userCode string) (storage.DeviceRequest, error) {
 	var req DeviceRequest
 	if err := cli.get(resourceDeviceRequest, strings.ToLower(userCode), &req); err != nil {
 		return storage.DeviceRequest{}, err
@@ -699,7 +699,7 @@ func (cli *client) CreateDeviceToken(ctx context.Context, t storage.DeviceToken)
 	return cli.post(resourceDeviceToken, cli.fromStorageDeviceToken(t))
 }
 
-func (cli *client) GetDeviceToken(deviceCode string) (storage.DeviceToken, error) {
+func (cli *client) GetDeviceToken(ctx context.Context, deviceCode string) (storage.DeviceToken, error) {
 	var token DeviceToken
 	if err := cli.get(resourceDeviceToken, deviceCode, &token); err != nil {
 		return storage.DeviceToken{}, err
@@ -712,8 +712,8 @@ func (cli *client) getDeviceToken(deviceCode string) (t DeviceToken, err error)
 	return
 }
 
-func (cli *client) UpdateDeviceToken(deviceCode string, updater func(old storage.DeviceToken) (storage.DeviceToken, error)) error {
-	return retryOnConflict(context.TODO(), func() error {
+func (cli *client) UpdateDeviceToken(ctx context.Context, deviceCode string, updater func(old storage.DeviceToken) (storage.DeviceToken, error)) error {
+	return retryOnConflict(ctx, func() error {
 		r, err := cli.getDeviceToken(deviceCode)
 		if err != nil {
 			return err
diff --git a/storage/memory/memory.go b/storage/memory/memory.go
index 4399c61d..eff75e71 100644
--- a/storage/memory/memory.go
+++ b/storage/memory/memory.go
@@ -71,7 +71,7 @@ func (s *memStorage) tx(f func()) {
 
 func (s *memStorage) Close() error { return nil }
 
-func (s *memStorage) GarbageCollect(now time.Time) (result storage.GCResult, err error) {
+func (s *memStorage) GarbageCollect(ctx context.Context, now time.Time) (result storage.GCResult, err error) {
 	s.tx(func() {
 		for id, a := range s.authCodes {
 			if now.After(a.Expiry) {
@@ -183,7 +183,7 @@ func (s *memStorage) CreateConnector(ctx context.Context, connector storage.Conn
 	return
 }
 
-func (s *memStorage) GetAuthCode(id string) (c storage.AuthCode, err error) {
+func (s *memStorage) GetAuthCode(ctx context.Context, id string) (c storage.AuthCode, err error) {
 	s.tx(func() {
 		var ok bool
 		if c, ok = s.authCodes[id]; !ok {
@@ -194,7 +194,7 @@ func (s *memStorage) GetAuthCode(id string) (c storage.AuthCode, err error) {
 	return
 }
 
-func (s *memStorage) GetPassword(email string) (p storage.Password, err error) {
+func (s *memStorage) GetPassword(ctx context.Context, email string) (p storage.Password, err error) {
 	email = strings.ToLower(email)
 	s.tx(func() {
 		var ok bool
@@ -205,7 +205,7 @@ func (s *memStorage) GetPassword(email string) (p storage.Password, err error) {
 	return
 }
 
-func (s *memStorage) GetClient(id string) (client storage.Client, err error) {
+func (s *memStorage) GetClient(ctx context.Context, id string) (client storage.Client, err error) {
 	s.tx(func() {
 		var ok bool
 		if client, ok = s.clients[id]; !ok {
@@ -215,12 +215,12 @@ func (s *memStorage) GetClient(id string) (client storage.Client, err error) {
 	return
 }
 
-func (s *memStorage) GetKeys() (keys storage.Keys, err error) {
+func (s *memStorage) GetKeys(ctx context.Context) (keys storage.Keys, err error) {
 	s.tx(func() { keys = s.keys })
 	return
 }
 
-func (s *memStorage) GetRefresh(id string) (tok storage.RefreshToken, err error) {
+func (s *memStorage) GetRefresh(ctx context.Context, id string) (tok storage.RefreshToken, err error) {
 	s.tx(func() {
 		var ok bool
 		if tok, ok = s.refreshTokens[id]; !ok {
@@ -231,7 +231,7 @@ func (s *memStorage) GetRefresh(id string) (tok storage.RefreshToken, err error)
 	return
 }
 
-func (s *memStorage) GetAuthRequest(id string) (req storage.AuthRequest, err error) {
+func (s *memStorage) GetAuthRequest(ctx context.Context, id string) (req storage.AuthRequest, err error) {
 	s.tx(func() {
 		var ok bool
 		if req, ok = s.authReqs[id]; !ok {
@@ -242,7 +242,7 @@ func (s *memStorage) GetAuthRequest(id string) (req storage.AuthRequest, err err
 	return
 }
 
-func (s *memStorage) GetOfflineSessions(userID string, connID string) (o storage.OfflineSessions, err error) {
+func (s *memStorage) GetOfflineSessions(ctx context.Context, userID string, connID string) (o storage.OfflineSessions, err error) {
 	id := offlineSessionID{
 		userID: userID,
 		connID: connID,
@@ -257,7 +257,7 @@ func (s *memStorage) GetOfflineSessions(userID string, connID string) (o storage
 	return
 }
 
-func (s *memStorage) GetConnector(id string) (connector storage.Connector, err error) {
+func (s *memStorage) GetConnector(ctx context.Context, id string) (connector storage.Connector, err error) {
 	s.tx(func() {
 		var ok bool
 		if connector, ok = s.connectors[id]; !ok {
@@ -267,7 +267,7 @@ func (s *memStorage) GetConnector(id string) (connector storage.Connector, err e
 	return
 }
 
-func (s *memStorage) ListClients() (clients []storage.Client, err error) {
+func (s *memStorage) ListClients(ctx context.Context) (clients []storage.Client, err error) {
 	s.tx(func() {
 		for _, client := range s.clients {
 			clients = append(clients, client)
@@ -276,7 +276,7 @@ func (s *memStorage) ListClients() (clients []storage.Client, err error) {
 	return
 }
 
-func (s *memStorage) ListRefreshTokens() (tokens []storage.RefreshToken, err error) {
+func (s *memStorage) ListRefreshTokens(ctx context.Context) (tokens []storage.RefreshToken, err error) {
 	s.tx(func() {
 		for _, refresh := range s.refreshTokens {
 			tokens = append(tokens, refresh)
@@ -285,7 +285,7 @@ func (s *memStorage) ListRefreshTokens() (tokens []storage.RefreshToken, err err
 	return
 }
 
-func (s *memStorage) ListPasswords() (passwords []storage.Password, err error) {
+func (s *memStorage) ListPasswords(ctx context.Context) (passwords []storage.Password, err error) {
 	s.tx(func() {
 		for _, password := range s.passwords {
 			passwords = append(passwords, password)
@@ -294,7 +294,7 @@ func (s *memStorage) ListPasswords() (passwords []storage.Password, err error) {
 	return
 }
 
-func (s *memStorage) ListConnectors() (conns []storage.Connector, err error) {
+func (s *memStorage) ListConnectors(ctx context.Context) (conns []storage.Connector, err error) {
 	s.tx(func() {
 		for _, c := range s.connectors {
 			conns = append(conns, c)
@@ -303,7 +303,7 @@ func (s *memStorage) ListConnectors() (conns []storage.Connector, err error) {
 	return
 }
 
-func (s *memStorage) DeletePassword(email string) (err error) {
+func (s *memStorage) DeletePassword(ctx context.Context, email string) (err error) {
 	email = strings.ToLower(email)
 	s.tx(func() {
 		if _, ok := s.passwords[email]; !ok {
@@ -315,7 +315,7 @@ func (s *memStorage) DeletePassword(email string) (err error) {
 	return
 }
 
-func (s *memStorage) DeleteClient(id string) (err error) {
+func (s *memStorage) DeleteClient(ctx context.Context, id string) (err error) {
 	s.tx(func() {
 		if _, ok := s.clients[id]; !ok {
 			err = storage.ErrNotFound
@@ -326,7 +326,7 @@ func (s *memStorage) DeleteClient(id string) (err error) {
 	return
 }
 
-func (s *memStorage) DeleteRefresh(id string) (err error) {
+func (s *memStorage) DeleteRefresh(ctx context.Context, id string) (err error) {
 	s.tx(func() {
 		if _, ok := s.refreshTokens[id]; !ok {
 			err = storage.ErrNotFound
@@ -337,7 +337,7 @@ func (s *memStorage) DeleteRefresh(id string) (err error) {
 	return
 }
 
-func (s *memStorage) DeleteAuthCode(id string) (err error) {
+func (s *memStorage) DeleteAuthCode(ctx context.Context, id string) (err error) {
 	s.tx(func() {
 		if _, ok := s.authCodes[id]; !ok {
 			err = storage.ErrNotFound
@@ -348,7 +348,7 @@ func (s *memStorage) DeleteAuthCode(id string) (err error) {
 	return
 }
 
-func (s *memStorage) DeleteAuthRequest(id string) (err error) {
+func (s *memStorage) DeleteAuthRequest(ctx context.Context, id string) (err error) {
 	s.tx(func() {
 		if _, ok := s.authReqs[id]; !ok {
 			err = storage.ErrNotFound
@@ -359,7 +359,7 @@ func (s *memStorage) DeleteAuthRequest(id string) (err error) {
 	return
 }
 
-func (s *memStorage) DeleteOfflineSessions(userID string, connID string) (err error) {
+func (s *memStorage) DeleteOfflineSessions(ctx context.Context, userID string, connID string) (err error) {
 	id := offlineSessionID{
 		userID: userID,
 		connID: connID,
@@ -374,7 +374,7 @@ func (s *memStorage) DeleteOfflineSessions(userID string, connID string) (err er
 	return
 }
 
-func (s *memStorage) DeleteConnector(id string) (err error) {
+func (s *memStorage) DeleteConnector(ctx context.Context, id string) (err error) {
 	s.tx(func() {
 		if _, ok := s.connectors[id]; !ok {
 			err = storage.ErrNotFound
@@ -385,7 +385,7 @@ func (s *memStorage) DeleteConnector(id string) (err error) {
 	return
 }
 
-func (s *memStorage) UpdateClient(id string, updater func(old storage.Client) (storage.Client, error)) (err error) {
+func (s *memStorage) UpdateClient(ctx context.Context, id string, updater func(old storage.Client) (storage.Client, error)) (err error) {
 	s.tx(func() {
 		client, ok := s.clients[id]
 		if !ok {
@@ -399,7 +399,7 @@ func (s *memStorage) UpdateClient(id string, updater func(old storage.Client) (s
 	return
 }
 
-func (s *memStorage) UpdateKeys(updater func(old storage.Keys) (storage.Keys, error)) (err error) {
+func (s *memStorage) UpdateKeys(ctx context.Context, updater func(old storage.Keys) (storage.Keys, error)) (err error) {
 	s.tx(func() {
 		var keys storage.Keys
 		if keys, err = updater(s.keys); err == nil {
@@ -409,7 +409,7 @@ func (s *memStorage) UpdateKeys(updater func(old storage.Keys) (storage.Keys, er
 	return
 }
 
-func (s *memStorage) UpdateAuthRequest(id string, updater func(old storage.AuthRequest) (storage.AuthRequest, error)) (err error) {
+func (s *memStorage) UpdateAuthRequest(ctx context.Context, id string, updater func(old storage.AuthRequest) (storage.AuthRequest, error)) (err error) {
 	s.tx(func() {
 		req, ok := s.authReqs[id]
 		if !ok {
@@ -423,7 +423,7 @@ func (s *memStorage) UpdateAuthRequest(id string, updater func(old storage.AuthR
 	return
 }
 
-func (s *memStorage) UpdatePassword(email string, updater func(p storage.Password) (storage.Password, error)) (err error) {
+func (s *memStorage) UpdatePassword(ctx context.Context, email string, updater func(p storage.Password) (storage.Password, error)) (err error) {
 	email = strings.ToLower(email)
 	s.tx(func() {
 		req, ok := s.passwords[email]
@@ -438,7 +438,7 @@ func (s *memStorage) UpdatePassword(email string, updater func(p storage.Passwor
 	return
 }
 
-func (s *memStorage) UpdateRefreshToken(id string, updater func(p storage.RefreshToken) (storage.RefreshToken, error)) (err error) {
+func (s *memStorage) UpdateRefreshToken(ctx context.Context, id string, updater func(p storage.RefreshToken) (storage.RefreshToken, error)) (err error) {
 	s.tx(func() {
 		r, ok := s.refreshTokens[id]
 		if !ok {
@@ -452,7 +452,7 @@ func (s *memStorage) UpdateRefreshToken(id string, updater func(p storage.Refres
 	return
 }
 
-func (s *memStorage) UpdateOfflineSessions(userID string, connID string, updater func(o storage.OfflineSessions) (storage.OfflineSessions, error)) (err error) {
+func (s *memStorage) UpdateOfflineSessions(ctx context.Context, userID string, connID string, updater func(o storage.OfflineSessions) (storage.OfflineSessions, error)) (err error) {
 	id := offlineSessionID{
 		userID: userID,
 		connID: connID,
@@ -470,7 +470,7 @@ func (s *memStorage) UpdateOfflineSessions(userID string, connID string, updater
 	return
 }
 
-func (s *memStorage) UpdateConnector(id string, updater func(c storage.Connector) (storage.Connector, error)) (err error) {
+func (s *memStorage) UpdateConnector(ctx context.Context, id string, updater func(c storage.Connector) (storage.Connector, error)) (err error) {
 	s.tx(func() {
 		r, ok := s.connectors[id]
 		if !ok {
@@ -495,7 +495,7 @@ func (s *memStorage) CreateDeviceRequest(ctx context.Context, d storage.DeviceRe
 	return
 }
 
-func (s *memStorage) GetDeviceRequest(userCode string) (req storage.DeviceRequest, err error) {
+func (s *memStorage) GetDeviceRequest(ctx context.Context, userCode string) (req storage.DeviceRequest, err error) {
 	s.tx(func() {
 		var ok bool
 		if req, ok = s.deviceRequests[userCode]; !ok {
@@ -517,7 +517,7 @@ func (s *memStorage) CreateDeviceToken(ctx context.Context, t storage.DeviceToke
 	return
 }
 
-func (s *memStorage) GetDeviceToken(deviceCode string) (t storage.DeviceToken, err error) {
+func (s *memStorage) GetDeviceToken(ctx context.Context, deviceCode string) (t storage.DeviceToken, err error) {
 	s.tx(func() {
 		var ok bool
 		if t, ok = s.deviceTokens[deviceCode]; !ok {
@@ -528,7 +528,7 @@ func (s *memStorage) GetDeviceToken(deviceCode string) (t storage.DeviceToken, e
 	return
 }
 
-func (s *memStorage) UpdateDeviceToken(deviceCode string, updater func(p storage.DeviceToken) (storage.DeviceToken, error)) (err error) {
+func (s *memStorage) UpdateDeviceToken(ctx context.Context, deviceCode string, updater func(p storage.DeviceToken) (storage.DeviceToken, error)) (err error) {
 	s.tx(func() {
 		r, ok := s.deviceTokens[deviceCode]
 		if !ok {
diff --git a/storage/sql/crud.go b/storage/sql/crud.go
index 1249243c..a9ca3816 100644
--- a/storage/sql/crud.go
+++ b/storage/sql/crud.go
@@ -86,7 +86,7 @@ type scanner interface {
 
 var _ storage.Storage = (*conn)(nil)
 
-func (c *conn) GarbageCollect(now time.Time) (storage.GCResult, error) {
+func (c *conn) GarbageCollect(ctc context.Context, now time.Time) (storage.GCResult, error) {
 	result := storage.GCResult{}
 
 	r, err := c.Exec(`delete from auth_request where expiry < $1`, now)
@@ -158,9 +158,9 @@ func (c *conn) CreateAuthRequest(ctx context.Context, a storage.AuthRequest) err
 	return nil
 }
 
-func (c *conn) UpdateAuthRequest(id string, updater func(a storage.AuthRequest) (storage.AuthRequest, error)) error {
+func (c *conn) UpdateAuthRequest(ctx context.Context, id string, updater func(a storage.AuthRequest) (storage.AuthRequest, error)) error {
 	return c.ExecTx(func(tx *trans) error {
-		r, err := getAuthRequest(tx, id)
+		r, err := getAuthRequest(ctx, tx, id)
 		if err != nil {
 			return err
 		}
@@ -200,11 +200,11 @@ func (c *conn) UpdateAuthRequest(id string, updater func(a storage.AuthRequest)
 	})
 }
 
-func (c *conn) GetAuthRequest(id string) (storage.AuthRequest, error) {
-	return getAuthRequest(c, id)
+func (c *conn) GetAuthRequest(ctx context.Context, id string) (storage.AuthRequest, error) {
+	return getAuthRequest(ctx, c, id)
 }
 
-func getAuthRequest(q querier, id string) (a storage.AuthRequest, err error) {
+func getAuthRequest(ctx context.Context, q querier, id string) (a storage.AuthRequest, err error) {
 	err = q.QueryRow(`
 		select
 			id, client_id, response_types, scopes, redirect_uri, nonce, state,
@@ -258,7 +258,7 @@ func (c *conn) CreateAuthCode(ctx context.Context, a storage.AuthCode) error {
 	return nil
 }
 
-func (c *conn) GetAuthCode(id string) (a storage.AuthCode, err error) {
+func (c *conn) GetAuthCode(ctx context.Context, id string) (a storage.AuthCode, err error) {
 	err = c.QueryRow(`
 		select
 			id, client_id, scopes, nonce, redirect_uri,
@@ -310,9 +310,9 @@ func (c *conn) CreateRefresh(ctx context.Context, r storage.RefreshToken) error
 	return nil
 }
 
-func (c *conn) UpdateRefreshToken(id string, updater func(old storage.RefreshToken) (storage.RefreshToken, error)) error {
+func (c *conn) UpdateRefreshToken(ctx context.Context, id string, updater func(old storage.RefreshToken) (storage.RefreshToken, error)) error {
 	return c.ExecTx(func(tx *trans) error {
-		r, err := getRefresh(tx, id)
+		r, err := getRefresh(ctx, tx, id)
 		if err != nil {
 			return err
 		}
@@ -354,11 +354,11 @@ func (c *conn) UpdateRefreshToken(id string, updater func(old storage.RefreshTok
 	})
 }
 
-func (c *conn) GetRefresh(id string) (storage.RefreshToken, error) {
-	return getRefresh(c, id)
+func (c *conn) GetRefresh(ctx context.Context, id string) (storage.RefreshToken, error) {
+	return getRefresh(ctx, c, id)
 }
 
-func getRefresh(q querier, id string) (storage.RefreshToken, error) {
+func getRefresh(ctx context.Context, q querier, id string) (storage.RefreshToken, error) {
 	return scanRefresh(q.QueryRow(`
 		select
 			id, client_id, scopes, nonce,
@@ -371,7 +371,7 @@ func getRefresh(q querier, id string) (storage.RefreshToken, error) {
 	`, id))
 }
 
-func (c *conn) ListRefreshTokens() ([]storage.RefreshToken, error) {
+func (c *conn) ListRefreshTokens(ctx context.Context) ([]storage.RefreshToken, error) {
 	rows, err := c.Query(`
 		select
 			id, client_id, scopes, nonce,
@@ -418,12 +418,12 @@ func scanRefresh(s scanner) (r storage.RefreshToken, err error) {
 	return r, nil
 }
 
-func (c *conn) UpdateKeys(updater func(old storage.Keys) (storage.Keys, error)) error {
+func (c *conn) UpdateKeys(ctx context.Context, updater func(old storage.Keys) (storage.Keys, error)) error {
 	return c.ExecTx(func(tx *trans) error {
 		firstUpdate := false
 		// TODO(ericchiang): errors may cause a transaction be rolled back by the SQL
 		// server. Test this, and consider adding a COUNT() command beforehand.
-		old, err := getKeys(tx)
+		old, err := getKeys(ctx, tx)
 		if err != nil {
 			if err != storage.ErrNotFound {
 				return fmt.Errorf("get keys: %v", err)
@@ -471,11 +471,11 @@ func (c *conn) UpdateKeys(updater func(old storage.Keys) (storage.Keys, error))
 	})
 }
 
-func (c *conn) GetKeys() (keys storage.Keys, err error) {
-	return getKeys(c)
+func (c *conn) GetKeys(ctx context.Context) (keys storage.Keys, err error) {
+	return getKeys(ctx, c)
 }
 
-func getKeys(q querier) (keys storage.Keys, err error) {
+func getKeys(ctx context.Context, q querier) (keys storage.Keys, err error) {
 	err = q.QueryRow(`
 		select
 			verification_keys, signing_key, signing_key_pub, next_rotation
@@ -494,9 +494,9 @@ func getKeys(q querier) (keys storage.Keys, err error) {
 	return keys, nil
 }
 
-func (c *conn) UpdateClient(id string, updater func(old storage.Client) (storage.Client, error)) error {
+func (c *conn) UpdateClient(ctx context.Context, id string, updater func(old storage.Client) (storage.Client, error)) error {
 	return c.ExecTx(func(tx *trans) error {
-		cli, err := getClient(tx, id)
+		cli, err := getClient(ctx, tx, id)
 		if err != nil {
 			return err
 		}
@@ -543,7 +543,7 @@ func (c *conn) CreateClient(ctx context.Context, cli storage.Client) error {
 	return nil
 }
 
-func getClient(q querier, id string) (storage.Client, error) {
+func getClient(ctx context.Context, q querier, id string) (storage.Client, error) {
 	return scanClient(q.QueryRow(`
 		select
 			id, secret, redirect_uris, trusted_peers, public, name, logo_url
@@ -551,11 +551,11 @@ func getClient(q querier, id string) (storage.Client, error) {
 	`, id))
 }
 
-func (c *conn) GetClient(id string) (storage.Client, error) {
-	return getClient(c, id)
+func (c *conn) GetClient(ctx context.Context, id string) (storage.Client, error) {
+	return getClient(ctx, c, id)
 }
 
-func (c *conn) ListClients() ([]storage.Client, error) {
+func (c *conn) ListClients(ctx context.Context) ([]storage.Client, error) {
 	rows, err := c.Query(`
 		select
 			id, secret, redirect_uris, trusted_peers, public, name, logo_url
@@ -615,9 +615,9 @@ func (c *conn) CreatePassword(ctx context.Context, p storage.Password) error {
 	return nil
 }
 
-func (c *conn) UpdatePassword(email string, updater func(p storage.Password) (storage.Password, error)) error {
+func (c *conn) UpdatePassword(ctx context.Context, email string, updater func(p storage.Password) (storage.Password, error)) error {
 	return c.ExecTx(func(tx *trans) error {
-		p, err := getPassword(tx, email)
+		p, err := getPassword(ctx, tx, email)
 		if err != nil {
 			return err
 		}
@@ -641,11 +641,11 @@ func (c *conn) UpdatePassword(email string, updater func(p storage.Password) (st
 	})
 }
 
-func (c *conn) GetPassword(email string) (storage.Password, error) {
-	return getPassword(c, email)
+func (c *conn) GetPassword(ctx context.Context, email string) (storage.Password, error) {
+	return getPassword(ctx, c, email)
 }
 
-func getPassword(q querier, email string) (p storage.Password, err error) {
+func getPassword(ctx context.Context, q querier, email string) (p storage.Password, err error) {
 	return scanPassword(q.QueryRow(`
 		select
 			email, hash, username, user_id
@@ -653,7 +653,7 @@ func getPassword(q querier, email string) (p storage.Password, err error) {
 	`, strings.ToLower(email)))
 }
 
-func (c *conn) ListPasswords() ([]storage.Password, error) {
+func (c *conn) ListPasswords(ctx context.Context) ([]storage.Password, error) {
 	rows, err := c.Query(`
 		select
 			email, hash, username, user_id
@@ -711,9 +711,9 @@ func (c *conn) CreateOfflineSessions(ctx context.Context, s storage.OfflineSessi
 	return nil
 }
 
-func (c *conn) UpdateOfflineSessions(userID string, connID string, updater func(s storage.OfflineSessions) (storage.OfflineSessions, error)) error {
+func (c *conn) UpdateOfflineSessions(ctx context.Context, userID string, connID string, updater func(s storage.OfflineSessions) (storage.OfflineSessions, error)) error {
 	return c.ExecTx(func(tx *trans) error {
-		s, err := getOfflineSessions(tx, userID, connID)
+		s, err := getOfflineSessions(ctx, tx, userID, connID)
 		if err != nil {
 			return err
 		}
@@ -738,11 +738,11 @@ func (c *conn) UpdateOfflineSessions(userID string, connID string, updater func(
 	})
 }
 
-func (c *conn) GetOfflineSessions(userID string, connID string) (storage.OfflineSessions, error) {
-	return getOfflineSessions(c, userID, connID)
+func (c *conn) GetOfflineSessions(ctx context.Context, userID string, connID string) (storage.OfflineSessions, error) {
+	return getOfflineSessions(ctx, c, userID, connID)
 }
 
-func getOfflineSessions(q querier, userID string, connID string) (storage.OfflineSessions, error) {
+func getOfflineSessions(ctx context.Context, q querier, userID string, connID string) (storage.OfflineSessions, error) {
 	return scanOfflineSessions(q.QueryRow(`
 		select
 			user_id, conn_id, refresh, connector_data
@@ -784,9 +784,9 @@ func (c *conn) CreateConnector(ctx context.Context, connector storage.Connector)
 	return nil
 }
 
-func (c *conn) UpdateConnector(id string, updater func(s storage.Connector) (storage.Connector, error)) error {
+func (c *conn) UpdateConnector(ctx context.Context, id string, updater func(s storage.Connector) (storage.Connector, error)) error {
 	return c.ExecTx(func(tx *trans) error {
-		connector, err := getConnector(tx, id)
+		connector, err := getConnector(ctx, tx, id)
 		if err != nil {
 			return err
 		}
@@ -813,11 +813,11 @@ func (c *conn) UpdateConnector(id string, updater func(s storage.Connector) (sto
 	})
 }
 
-func (c *conn) GetConnector(id string) (storage.Connector, error) {
-	return getConnector(c, id)
+func (c *conn) GetConnector(ctx context.Context, id string) (storage.Connector, error) {
+	return getConnector(ctx, c, id)
 }
 
-func getConnector(q querier, id string) (storage.Connector, error) {
+func getConnector(ctx context.Context, q querier, id string) (storage.Connector, error) {
 	return scanConnector(q.QueryRow(`
 		select
 			id, type, name, resource_version, config
@@ -839,7 +839,7 @@ func scanConnector(s scanner) (c storage.Connector, err error) {
 	return c, nil
 }
 
-func (c *conn) ListConnectors() ([]storage.Connector, error) {
+func (c *conn) ListConnectors(ctx context.Context) ([]storage.Connector, error) {
 	rows, err := c.Query(`
 		select
 			id, type, name, resource_version, config
@@ -864,16 +864,31 @@ func (c *conn) ListConnectors() ([]storage.Connector, error) {
 	return connectors, nil
 }
 
-func (c *conn) DeleteAuthRequest(id string) error { return c.delete("auth_request", "id", id) }
-func (c *conn) DeleteAuthCode(id string) error    { return c.delete("auth_code", "id", id) }
-func (c *conn) DeleteClient(id string) error      { return c.delete("client", "id", id) }
-func (c *conn) DeleteRefresh(id string) error     { return c.delete("refresh_token", "id", id) }
-func (c *conn) DeletePassword(email string) error {
+func (c *conn) DeleteAuthRequest(ctx context.Context, id string) error {
+	return c.delete("auth_request", "id", id)
+}
+
+func (c *conn) DeleteAuthCode(ctx context.Context, id string) error {
+	return c.delete("auth_code", "id", id)
+}
+
+func (c *conn) DeleteClient(ctx context.Context, id string) error {
+	return c.delete("client", "id", id)
+}
+
+func (c *conn) DeleteRefresh(ctx context.Context, id string) error {
+	return c.delete("refresh_token", "id", id)
+}
+
+func (c *conn) DeletePassword(ctx context.Context, email string) error {
 	return c.delete("password", "email", strings.ToLower(email))
 }
-func (c *conn) DeleteConnector(id string) error { return c.delete("connector", "id", id) }
 
-func (c *conn) DeleteOfflineSessions(userID string, connID string) error {
+func (c *conn) DeleteConnector(ctx context.Context, id string) error {
+	return c.delete("connector", "id", id)
+}
+
+func (c *conn) DeleteOfflineSessions(ctx context.Context, userID string, connID string) error {
 	result, err := c.Exec(`delete from offline_session where user_id = $1 AND conn_id = $2`, userID, connID)
 	if err != nil {
 		return fmt.Errorf("delete offline_session: user_id = %s, conn_id = %s", userID, connID)
@@ -948,11 +963,11 @@ func (c *conn) CreateDeviceToken(ctx context.Context, t storage.DeviceToken) err
 	return nil
 }
 
-func (c *conn) GetDeviceRequest(userCode string) (storage.DeviceRequest, error) {
-	return getDeviceRequest(c, userCode)
+func (c *conn) GetDeviceRequest(ctx context.Context, userCode string) (storage.DeviceRequest, error) {
+	return getDeviceRequest(ctx, c, userCode)
 }
 
-func getDeviceRequest(q querier, userCode string) (d storage.DeviceRequest, err error) {
+func getDeviceRequest(ctx context.Context, q querier, userCode string) (d storage.DeviceRequest, err error) {
 	err = q.QueryRow(`
 		select
             device_code, client_id, client_secret, scopes, expiry
@@ -970,11 +985,11 @@ func getDeviceRequest(q querier, userCode string) (d storage.DeviceRequest, err
 	return d, nil
 }
 
-func (c *conn) GetDeviceToken(deviceCode string) (storage.DeviceToken, error) {
-	return getDeviceToken(c, deviceCode)
+func (c *conn) GetDeviceToken(ctx context.Context, deviceCode string) (storage.DeviceToken, error) {
+	return getDeviceToken(ctx, c, deviceCode)
 }
 
-func getDeviceToken(q querier, deviceCode string) (a storage.DeviceToken, err error) {
+func getDeviceToken(ctx context.Context, q querier, deviceCode string) (a storage.DeviceToken, err error) {
 	err = q.QueryRow(`
 		select
             status, token, expiry, last_request, poll_interval, code_challenge, code_challenge_method
@@ -992,9 +1007,9 @@ func getDeviceToken(q querier, deviceCode string) (a storage.DeviceToken, err er
 	return a, nil
 }
 
-func (c *conn) UpdateDeviceToken(deviceCode string, updater func(old storage.DeviceToken) (storage.DeviceToken, error)) error {
+func (c *conn) UpdateDeviceToken(ctx context.Context, deviceCode string, updater func(old storage.DeviceToken) (storage.DeviceToken, error)) error {
 	return c.ExecTx(func(tx *trans) error {
-		r, err := getDeviceToken(tx, deviceCode)
+		r, err := getDeviceToken(ctx, tx, deviceCode)
 		if err != nil {
 			return err
 		}
diff --git a/storage/static.go b/storage/static.go
index ca04937a..386b2b28 100644
--- a/storage/static.go
+++ b/storage/static.go
@@ -31,11 +31,11 @@ func WithStaticClients(s Storage, staticClients []Client) Storage {
 	return staticClientsStorage{s, staticClients, clientsByID}
 }
 
-func (s staticClientsStorage) GetClient(id string) (Client, error) {
+func (s staticClientsStorage) GetClient(ctx context.Context, id string) (Client, error) {
 	if client, ok := s.clientsByID[id]; ok {
 		return client, nil
 	}
-	return s.Storage.GetClient(id)
+	return s.Storage.GetClient(ctx, id)
 }
 
 func (s staticClientsStorage) isStatic(id string) bool {
@@ -43,8 +43,8 @@ func (s staticClientsStorage) isStatic(id string) bool {
 	return ok
 }
 
-func (s staticClientsStorage) ListClients() ([]Client, error) {
-	clients, err := s.Storage.ListClients()
+func (s staticClientsStorage) ListClients(ctx context.Context) ([]Client, error) {
+	clients, err := s.Storage.ListClients(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -67,18 +67,18 @@ func (s staticClientsStorage) CreateClient(ctx context.Context, c Client) error
 	return s.Storage.CreateClient(ctx, c)
 }
 
-func (s staticClientsStorage) DeleteClient(id string) error {
+func (s staticClientsStorage) DeleteClient(ctx context.Context, id string) error {
 	if s.isStatic(id) {
 		return errors.New("static clients: read-only cannot delete client")
 	}
-	return s.Storage.DeleteClient(id)
+	return s.Storage.DeleteClient(ctx, id)
 }
 
-func (s staticClientsStorage) UpdateClient(id string, updater func(old Client) (Client, error)) error {
+func (s staticClientsStorage) UpdateClient(ctx context.Context, id string, updater func(old Client) (Client, error)) error {
 	if s.isStatic(id) {
 		return errors.New("static clients: read-only cannot update client")
 	}
-	return s.Storage.UpdateClient(id, updater)
+	return s.Storage.UpdateClient(ctx, id, updater)
 }
 
 type staticPasswordsStorage struct {
@@ -112,18 +112,18 @@ func (s staticPasswordsStorage) isStatic(email string) bool {
 	return ok
 }
 
-func (s staticPasswordsStorage) GetPassword(email string) (Password, error) {
+func (s staticPasswordsStorage) GetPassword(ctx context.Context, email string) (Password, error) {
 	// TODO(ericchiang): BLAH. We really need to figure out how to handle
 	// lower cased emails better.
 	email = strings.ToLower(email)
 	if password, ok := s.passwordsByEmail[email]; ok {
 		return password, nil
 	}
-	return s.Storage.GetPassword(email)
+	return s.Storage.GetPassword(ctx, email)
 }
 
-func (s staticPasswordsStorage) ListPasswords() ([]Password, error) {
-	passwords, err := s.Storage.ListPasswords()
+func (s staticPasswordsStorage) ListPasswords(ctx context.Context) ([]Password, error) {
+	passwords, err := s.Storage.ListPasswords(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -147,18 +147,18 @@ func (s staticPasswordsStorage) CreatePassword(ctx context.Context, p Password)
 	return s.Storage.CreatePassword(ctx, p)
 }
 
-func (s staticPasswordsStorage) DeletePassword(email string) error {
+func (s staticPasswordsStorage) DeletePassword(ctx context.Context, email string) error {
 	if s.isStatic(email) {
 		return errors.New("static passwords: read-only cannot delete password")
 	}
-	return s.Storage.DeletePassword(email)
+	return s.Storage.DeletePassword(ctx, email)
 }
 
-func (s staticPasswordsStorage) UpdatePassword(email string, updater func(old Password) (Password, error)) error {
+func (s staticPasswordsStorage) UpdatePassword(ctx context.Context, email string, updater func(old Password) (Password, error)) error {
 	if s.isStatic(email) {
 		return errors.New("static passwords: read-only cannot update password")
 	}
-	return s.Storage.UpdatePassword(email, updater)
+	return s.Storage.UpdatePassword(ctx, email, updater)
 }
 
 // staticConnectorsStorage represents a storage with read-only set of connectors.
@@ -185,15 +185,15 @@ func (s staticConnectorsStorage) isStatic(id string) bool {
 	return ok
 }
 
-func (s staticConnectorsStorage) GetConnector(id string) (Connector, error) {
+func (s staticConnectorsStorage) GetConnector(ctx context.Context, id string) (Connector, error) {
 	if connector, ok := s.connectorsByID[id]; ok {
 		return connector, nil
 	}
-	return s.Storage.GetConnector(id)
+	return s.Storage.GetConnector(ctx, id)
 }
 
-func (s staticConnectorsStorage) ListConnectors() ([]Connector, error) {
-	connectors, err := s.Storage.ListConnectors()
+func (s staticConnectorsStorage) ListConnectors(ctx context.Context) ([]Connector, error) {
+	connectors, err := s.Storage.ListConnectors(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -217,16 +217,16 @@ func (s staticConnectorsStorage) CreateConnector(ctx context.Context, c Connecto
 	return s.Storage.CreateConnector(ctx, c)
 }
 
-func (s staticConnectorsStorage) DeleteConnector(id string) error {
+func (s staticConnectorsStorage) DeleteConnector(ctx context.Context, id string) error {
 	if s.isStatic(id) {
 		return errors.New("static connectors: read-only cannot delete connector")
 	}
-	return s.Storage.DeleteConnector(id)
+	return s.Storage.DeleteConnector(ctx, id)
 }
 
-func (s staticConnectorsStorage) UpdateConnector(id string, updater func(old Connector) (Connector, error)) error {
+func (s staticConnectorsStorage) UpdateConnector(ctx context.Context, id string, updater func(old Connector) (Connector, error)) error {
 	if s.isStatic(id) {
 		return errors.New("static connectors: read-only cannot update connector")
 	}
-	return s.Storage.UpdateConnector(id, updater)
+	return s.Storage.UpdateConnector(ctx, id, updater)
 }
diff --git a/storage/storage.go b/storage/storage.go
index 03883ef5..574b0a5a 100644
--- a/storage/storage.go
+++ b/storage/storage.go
@@ -89,30 +89,30 @@ type Storage interface {
 
 	// TODO(ericchiang): return (T, bool, error) so we can indicate not found
 	// requests that way instead of using ErrNotFound.
-	GetAuthRequest(id string) (AuthRequest, error)
-	GetAuthCode(id string) (AuthCode, error)
-	GetClient(id string) (Client, error)
-	GetKeys() (Keys, error)
-	GetRefresh(id string) (RefreshToken, error)
-	GetPassword(email string) (Password, error)
-	GetOfflineSessions(userID string, connID string) (OfflineSessions, error)
-	GetConnector(id string) (Connector, error)
-	GetDeviceRequest(userCode string) (DeviceRequest, error)
-	GetDeviceToken(deviceCode string) (DeviceToken, error)
-
-	ListClients() ([]Client, error)
-	ListRefreshTokens() ([]RefreshToken, error)
-	ListPasswords() ([]Password, error)
-	ListConnectors() ([]Connector, error)
+	GetAuthRequest(ctx context.Context, id string) (AuthRequest, error)
+	GetAuthCode(ctx context.Context, id string) (AuthCode, error)
+	GetClient(ctx context.Context, id string) (Client, error)
+	GetKeys(ctx context.Context) (Keys, error)
+	GetRefresh(ctx context.Context, id string) (RefreshToken, error)
+	GetPassword(ctx context.Context, email string) (Password, error)
+	GetOfflineSessions(ctx context.Context, userID string, connID string) (OfflineSessions, error)
+	GetConnector(ctx context.Context, id string) (Connector, error)
+	GetDeviceRequest(ctx context.Context, userCode string) (DeviceRequest, error)
+	GetDeviceToken(ctx context.Context, deviceCode string) (DeviceToken, error)
+
+	ListClients(ctx context.Context) ([]Client, error)
+	ListRefreshTokens(ctx context.Context) ([]RefreshToken, error)
+	ListPasswords(ctx context.Context) ([]Password, error)
+	ListConnectors(ctx context.Context) ([]Connector, error)
 
 	// Delete methods MUST be atomic.
-	DeleteAuthRequest(id string) error
-	DeleteAuthCode(code string) error
-	DeleteClient(id string) error
-	DeleteRefresh(id string) error
-	DeletePassword(email string) error
-	DeleteOfflineSessions(userID string, connID string) error
-	DeleteConnector(id string) error
+	DeleteAuthRequest(ctx context.Context, id string) error
+	DeleteAuthCode(ctx context.Context, code string) error
+	DeleteClient(ctx context.Context, id string) error
+	DeleteRefresh(ctx context.Context, id string) error
+	DeletePassword(ctx context.Context, email string) error
+	DeleteOfflineSessions(ctx context.Context, userID string, connID string) error
+	DeleteConnector(ctx context.Context, id string) error
 
 	// Update methods take a function for updating an object then performs that update within
 	// a transaction. "updater" functions may be called multiple times by a single update call.
@@ -128,18 +128,18 @@ type Storage interface {
 	//			// update failed, handle error
 	//		}
 	//
-	UpdateClient(id string, updater func(old Client) (Client, error)) error
-	UpdateKeys(updater func(old Keys) (Keys, error)) error
-	UpdateAuthRequest(id string, updater func(a AuthRequest) (AuthRequest, error)) error
-	UpdateRefreshToken(id string, updater func(r RefreshToken) (RefreshToken, error)) error
-	UpdatePassword(email string, updater func(p Password) (Password, error)) error
-	UpdateOfflineSessions(userID string, connID string, updater func(s OfflineSessions) (OfflineSessions, error)) error
-	UpdateConnector(id string, updater func(c Connector) (Connector, error)) error
-	UpdateDeviceToken(deviceCode string, updater func(t DeviceToken) (DeviceToken, error)) error
+	UpdateClient(ctx context.Context, id string, updater func(old Client) (Client, error)) error
+	UpdateKeys(ctx context.Context, updater func(old Keys) (Keys, error)) error
+	UpdateAuthRequest(ctx context.Context, id string, updater func(a AuthRequest) (AuthRequest, error)) error
+	UpdateRefreshToken(ctx context.Context, id string, updater func(r RefreshToken) (RefreshToken, error)) error
+	UpdatePassword(ctx context.Context, email string, updater func(p Password) (Password, error)) error
+	UpdateOfflineSessions(ctx context.Context, userID string, connID string, updater func(s OfflineSessions) (OfflineSessions, error)) error
+	UpdateConnector(ctx context.Context, id string, updater func(c Connector) (Connector, error)) error
+	UpdateDeviceToken(ctx context.Context, deviceCode string, updater func(t DeviceToken) (DeviceToken, error)) error
 
 	// GarbageCollect deletes all expired AuthCodes,
 	// AuthRequests, DeviceRequests, and DeviceTokens.
-	GarbageCollect(now time.Time) (GCResult, error)
+	GarbageCollect(ctx context.Context, now time.Time) (GCResult, error)
 }
 
 // Client represents an OAuth2 client.


Test patch:
diff --git a/connector/authproxy/authproxy_test.go b/connector/authproxy/authproxy_test.go
index fdcf4038..fb468ea1 100644
--- a/connector/authproxy/authproxy_test.go
+++ b/connector/authproxy/authproxy_test.go
@@ -11,15 +11,16 @@ import (
 )
 
 const (
-	testEmail        = "testuser@example.com"
-	testGroup1       = "group1"
-	testGroup2       = "group2"
-	testGroup3       = "group 3"
-	testGroup4       = "group 4"
-	testStaticGroup1 = "static1"
-	testStaticGroup2 = "static 2"
-	testUsername     = "testuser"
-	testUserID       = "1234567890"
+	testEmail             = "testuser@example.com"
+	testGroup1            = "group1"
+	testGroup2            = "group2"
+	testGroup3            = "group 3"
+	testGroup4            = "group 4"
+	testStaticGroup1      = "static1"
+	testStaticGroup2      = "static 2"
+	testUsername          = "Test User"
+	testPreferredUsername = "testuser"
+	testUserID            = "1234567890"
 )
 
 var logger = slog.New(slog.NewTextHandler(io.Discard, &slog.HandlerOptions{}))
@@ -49,16 +50,18 @@ func TestUser(t *testing.T) {
 
 func TestExtraHeaders(t *testing.T) {
 	config := Config{
-		UserIDHeader: "X-Remote-User-Id",
-		UserHeader:   "X-Remote-User",
-		EmailHeader:  "X-Remote-User-Email",
+		UserIDHeader:   "X-Remote-User-Id",
+		UserHeader:     "X-Remote-User",
+		UserNameHeader: "X-Remote-User-Name",
+		EmailHeader:    "X-Remote-User-Email",
 	}
 	conn := callback{
-		userHeader:   config.UserHeader,
-		userIDHeader: config.UserIDHeader,
-		emailHeader:  config.EmailHeader,
-		logger:       logger,
-		pathSuffix:   "/test",
+		userHeader:     config.UserHeader,
+		userIDHeader:   config.UserIDHeader,
+		userNameHeader: config.UserNameHeader,
+		emailHeader:    config.EmailHeader,
+		logger:         logger,
+		pathSuffix:     "/test",
 	}
 
 	req, err := http.NewRequest("GET", "/", nil)
@@ -66,6 +69,7 @@ func TestExtraHeaders(t *testing.T) {
 	req.Header = map[string][]string{
 		"X-Remote-User-Id":    {testUserID},
 		"X-Remote-User":       {testUsername},
+		"X-Remote-User-Name":  {testPreferredUsername},
 		"X-Remote-User-Email": {testEmail},
 	}
 
@@ -73,7 +77,7 @@ func TestExtraHeaders(t *testing.T) {
 	expectNil(t, err)
 
 	expectEquals(t, ident.UserID, testUserID)
-	expectEquals(t, ident.PreferredUsername, testUsername)
+	expectEquals(t, ident.PreferredUsername, testPreferredUsername)
 	expectEquals(t, ident.Username, testUsername)
 	expectEquals(t, ident.Email, testEmail)
 	expectEquals(t, len(ident.Groups), 0)
diff --git a/server/api_test.go b/server/api_test.go
index af8d363f..d929ff31 100644
--- a/server/api_test.go
+++ b/server/api_test.go
@@ -149,7 +149,7 @@ func TestPassword(t *testing.T) {
 		t.Fatalf("Unable to update password: %v", err)
 	}
 
-	pass, err := s.GetPassword(updateReq.Email)
+	pass, err := s.GetPassword(ctx, updateReq.Email)
 	if err != nil {
 		t.Fatalf("Unable to retrieve password: %v", err)
 	}
@@ -449,7 +449,7 @@ func TestUpdateClient(t *testing.T) {
 					t.Errorf("expected in response NotFound: %t", tc.want.NotFound)
 				}
 
-				client, err := s.GetClient(tc.req.Id)
+				client, err := s.GetClient(ctx, tc.req.Id)
 				if err != nil {
 					t.Errorf("no client found in the storage: %v", err)
 				}
diff --git a/server/handlers_test.go b/server/handlers_test.go
index 08b02f75..1aa4bfa5 100644
--- a/server/handlers_test.go
+++ b/server/handlers_test.go
@@ -138,7 +138,7 @@ type emptyStorage struct {
 	storage.Storage
 }
 
-func (*emptyStorage) GetAuthRequest(string) (storage.AuthRequest, error) {
+func (*emptyStorage) GetAuthRequest(context.Context, string) (storage.AuthRequest, error) {
 	return storage.AuthRequest{}, storage.ErrNotFound
 }
 
@@ -407,7 +407,7 @@ func TestHandlePassword(t *testing.T) {
 				err := json.Unmarshal(rr.Body.Bytes(), &ref)
 				require.NoError(t, err)
 
-				newSess, err := s.storage.GetOfflineSessions("0-385-28089-0", "test")
+				newSess, err := s.storage.GetOfflineSessions(ctx, "0-385-28089-0", "test")
 				if tc.offlineSessionCreated {
 					require.NoError(t, err)
 					require.Equal(t, `{"test": "true"}`, string(newSess.ConnectorData))
@@ -562,7 +562,7 @@ func TestHandlePasswordLoginWithSkipApproval(t *testing.T) {
 			cb, _ := url.Parse(resp.Header.Get("Location"))
 			require.Equal(t, tc.expectedRes, cb.Path)
 
-			offlineSession, err := s.storage.GetOfflineSessions("0-385-28089-0", connID)
+			offlineSession, err := s.storage.GetOfflineSessions(ctx, "0-385-28089-0", connID)
 			if tc.offlineSessionCreated {
 				require.NoError(t, err)
 				require.NotEmpty(t, offlineSession)
@@ -701,7 +701,7 @@ func TestHandleConnectorCallbackWithSkipApproval(t *testing.T) {
 			cb, _ := url.Parse(resp.Header.Get("Location"))
 			require.Equal(t, tc.expectedRes, cb.Path)
 
-			offlineSession, err := s.storage.GetOfflineSessions("0-385-28089-0", connID)
+			offlineSession, err := s.storage.GetOfflineSessions(ctx, "0-385-28089-0", connID)
 			if tc.offlineSessionCreated {
 				require.NoError(t, err)
 				require.NotEmpty(t, offlineSession)
diff --git a/server/oauth2_test.go b/server/oauth2_test.go
index 2b733df8..70e4095c 100644
--- a/server/oauth2_test.go
+++ b/server/oauth2_test.go
@@ -599,7 +599,7 @@ func TestValidRedirectURI(t *testing.T) {
 
 func TestStorageKeySet(t *testing.T) {
 	s := memory.New(logger)
-	if err := s.UpdateKeys(func(keys storage.Keys) (storage.Keys, error) {
+	if err := s.UpdateKeys(context.TODO(), func(keys storage.Keys) (storage.Keys, error) {
 		keys.SigningKey = &jose.JSONWebKey{
 			Key:       testKey,
 			KeyID:     "testkey",
diff --git a/server/rotation_test.go b/server/rotation_test.go
index 1d0d2f10..17e06c6d 100644
--- a/server/rotation_test.go
+++ b/server/rotation_test.go
@@ -1,6 +1,7 @@
 package server
 
 import (
+	"context"
 	"io"
 	"log/slog"
 	"sort"
@@ -14,7 +15,7 @@ import (
 )
 
 func signingKeyID(t *testing.T, s storage.Storage) string {
-	keys, err := s.GetKeys()
+	keys, err := s.GetKeys(context.TODO())
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -22,7 +23,7 @@ func signingKeyID(t *testing.T, s storage.Storage) string {
 }
 
 func verificationKeyIDs(t *testing.T, s storage.Storage) (ids []string) {
-	keys, err := s.GetKeys()
+	keys, err := s.GetKeys(context.TODO())
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/server/server_test.go b/server/server_test.go
index 8936c90a..1e8c4df0 100644
--- a/server/server_test.go
+++ b/server/server_test.go
@@ -875,7 +875,7 @@ func TestOAuth2CodeFlow(t *testing.T) {
 				t.Fatal(err)
 			}
 
-			tokens, err := s.storage.ListRefreshTokens()
+			tokens, err := s.storage.ListRefreshTokens(ctx)
 			if err != nil {
 				t.Fatalf("failed to get existed refresh token: %v", err)
 			}
@@ -1369,15 +1369,15 @@ type storageWithKeysTrigger struct {
 	f func()
 }
 
-func (s storageWithKeysTrigger) GetKeys() (storage.Keys, error) {
+func (s storageWithKeysTrigger) GetKeys(ctx context.Context) (storage.Keys, error) {
 	s.f()
-	return s.Storage.GetKeys()
+	return s.Storage.GetKeys(ctx)
 }
 
 func TestKeyCacher(t *testing.T) {
 	tNow := time.Now()
 	now := func() time.Time { return tNow }
-
+	ctx := context.TODO()
 	s := memory.New(logger)
 
 	tests := []struct {
@@ -1390,7 +1390,7 @@ func TestKeyCacher(t *testing.T) {
 		},
 		{
 			before: func() {
-				s.UpdateKeys(func(old storage.Keys) (storage.Keys, error) {
+				s.UpdateKeys(ctx, func(old storage.Keys) (storage.Keys, error) {
 					old.NextRotation = tNow.Add(time.Minute)
 					return old, nil
 				})
@@ -1410,7 +1410,7 @@ func TestKeyCacher(t *testing.T) {
 		{
 			before: func() {
 				tNow = tNow.Add(time.Hour)
-				s.UpdateKeys(func(old storage.Keys) (storage.Keys, error) {
+				s.UpdateKeys(ctx, func(old storage.Keys) (storage.Keys, error) {
 					old.NextRotation = tNow.Add(time.Minute)
 					return old, nil
 				})
@@ -1428,7 +1428,7 @@ func TestKeyCacher(t *testing.T) {
 	for i, tc := range tests {
 		gotCall = false
 		tc.before()
-		s.GetKeys()
+		s.GetKeys(context.TODO())
 		if gotCall != tc.wantCallToStorage {
 			t.Errorf("case %d: expected call to storage=%t got call to storage=%t", i, tc.wantCallToStorage, gotCall)
 		}
diff --git a/storage/kubernetes/storage_test.go b/storage/kubernetes/storage_test.go
index d8bfd1f6..525bd904 100644
--- a/storage/kubernetes/storage_test.go
+++ b/storage/kubernetes/storage_test.go
@@ -221,7 +221,7 @@ func TestUpdateKeys(t *testing.T) {
 	for _, test := range tests {
 		client := newStatusCodesResponseTestClient(test.getResponseCode, test.actionResponseCode)
 
-		err := client.UpdateKeys(test.updater)
+		err := client.UpdateKeys(context.TODO(), test.updater)
 		if err != nil {
 			if !test.wantErr {
 				t.Fatalf("Test %q: %v", test.name, err)
@@ -339,9 +339,9 @@ func TestRefreshTokenLock(t *testing.T) {
 	require.NoError(t, err)
 
 	t.Run("Timeout lock error", func(t *testing.T) {
-		err = kubeClient.UpdateRefreshToken(r.ID, func(r storage.RefreshToken) (storage.RefreshToken, error) {
+		err = kubeClient.UpdateRefreshToken(ctx, r.ID, func(r storage.RefreshToken) (storage.RefreshToken, error) {
 			r.Token = "update-result-1"
-			err := kubeClient.UpdateRefreshToken(r.ID, func(r storage.RefreshToken) (storage.RefreshToken, error) {
+			err := kubeClient.UpdateRefreshToken(ctx, r.ID, func(r storage.RefreshToken) (storage.RefreshToken, error) {
 				r.Token = "timeout-err"
 				return r, nil
 			})
@@ -350,7 +350,7 @@ func TestRefreshTokenLock(t *testing.T) {
 		})
 		require.NoError(t, err)
 
-		token, err := kubeClient.GetRefresh(r.ID)
+		token, err := kubeClient.GetRefresh(context.TODO(), r.ID)
 		require.NoError(t, err)
 		require.Equal(t, "update-result-1", token.Token)
 	})
@@ -359,13 +359,13 @@ func TestRefreshTokenLock(t *testing.T) {
 		var lockBroken bool
 		lockTimeout = -time.Hour
 
-		err = kubeClient.UpdateRefreshToken(r.ID, func(r storage.RefreshToken) (storage.RefreshToken, error) {
+		err = kubeClient.UpdateRefreshToken(ctx, r.ID, func(r storage.RefreshToken) (storage.RefreshToken, error) {
 			r.Token = "update-result-2"
 			if lockBroken {
 				return r, nil
 			}
 
-			err := kubeClient.UpdateRefreshToken(r.ID, func(r storage.RefreshToken) (storage.RefreshToken, error) {
+			err := kubeClient.UpdateRefreshToken(ctx, r.ID, func(r storage.RefreshToken) (storage.RefreshToken, error) {
 				r.Token = "should-break-the-lock-and-finish-updating"
 				return r, nil
 			})
@@ -376,7 +376,7 @@ func TestRefreshTokenLock(t *testing.T) {
 		})
 		require.NoError(t, err)
 
-		token, err := kubeClient.GetRefresh(r.ID)
+		token, err := kubeClient.GetRefresh(context.TODO(), r.ID)
 		require.NoError(t, err)
 		// Because concurrent update breaks the lock, the final result will be the value of the first update
 		require.Equal(t, "update-result-2", token.Token)
diff --git a/storage/memory/static_test.go b/storage/memory/static_test.go
index b9138742..8f58c845 100644
--- a/storage/memory/static_test.go
+++ b/storage/memory/static_test.go
@@ -31,14 +31,14 @@ func TestStaticClients(t *testing.T) {
 		{
 			name: "get client from static storage",
 			action: func() error {
-				_, err := s.GetClient(c2.ID)
+				_, err := s.GetClient(ctx, c2.ID)
 				return err
 			},
 		},
 		{
 			name: "get client from backing storage",
 			action: func() error {
-				_, err := s.GetClient(c1.ID)
+				_, err := s.GetClient(ctx, c1.ID)
 				return err
 			},
 		},
@@ -49,7 +49,7 @@ func TestStaticClients(t *testing.T) {
 					c.Secret = "new_" + c.Secret
 					return c, nil
 				}
-				return s.UpdateClient(c2.ID, updater)
+				return s.UpdateClient(ctx, c2.ID, updater)
 			},
 			wantErr: true,
 		},
@@ -60,13 +60,13 @@ func TestStaticClients(t *testing.T) {
 					c.Secret = "new_" + c.Secret
 					return c, nil
 				}
-				return s.UpdateClient(c1.ID, updater)
+				return s.UpdateClient(ctx, c1.ID, updater)
 			},
 		},
 		{
 			name: "list clients",
 			action: func() error {
-				clients, err := s.ListClients()
+				clients, err := s.ListClients(ctx)
 				if err != nil {
 					return err
 				}
@@ -116,21 +116,21 @@ func TestStaticPasswords(t *testing.T) {
 		{
 			name: "get password from static storage",
 			action: func() error {
-				_, err := s.GetPassword(p2.Email)
+				_, err := s.GetPassword(ctx, p2.Email)
 				return err
 			},
 		},
 		{
 			name: "get password from backing storage",
 			action: func() error {
-				_, err := s.GetPassword(p1.Email)
+				_, err := s.GetPassword(ctx, p1.Email)
 				return err
 			},
 		},
 		{
 			name: "get password from static storage with casing",
 			action: func() error {
-				_, err := s.GetPassword(strings.ToUpper(p2.Email))
+				_, err := s.GetPassword(ctx, strings.ToUpper(p2.Email))
 				return err
 			},
 		},
@@ -141,7 +141,7 @@ func TestStaticPasswords(t *testing.T) {
 					p.Username = "new_" + p.Username
 					return p, nil
 				}
-				return s.UpdatePassword(p2.Email, updater)
+				return s.UpdatePassword(ctx, p2.Email, updater)
 			},
 			wantErr: true,
 		},
@@ -152,7 +152,7 @@ func TestStaticPasswords(t *testing.T) {
 					p.Username = "new_" + p.Username
 					return p, nil
 				}
-				return s.UpdatePassword(p1.Email, updater)
+				return s.UpdatePassword(ctx, p1.Email, updater)
 			},
 		},
 		{
@@ -168,7 +168,7 @@ func TestStaticPasswords(t *testing.T) {
 		{
 			name: "get password",
 			action: func() error {
-				p, err := s.GetPassword(p4.Email)
+				p, err := s.GetPassword(ctx, p4.Email)
 				if err != nil {
 					return err
 				}
@@ -181,7 +181,7 @@ func TestStaticPasswords(t *testing.T) {
 		{
 			name: "list passwords",
 			action: func() error {
-				passwords, err := s.ListPasswords()
+				passwords, err := s.ListPasswords(ctx)
 				if err != nil {
 					return err
 				}
@@ -228,14 +228,14 @@ func TestStaticConnectors(t *testing.T) {
 		{
 			name: "get connector from static storage",
 			action: func() error {
-				_, err := s.GetConnector(c2.ID)
+				_, err := s.GetConnector(ctx, c2.ID)
 				return err
 			},
 		},
 		{
 			name: "get connector from backing storage",
 			action: func() error {
-				_, err := s.GetConnector(c1.ID)
+				_, err := s.GetConnector(ctx, c1.ID)
 				return err
 			},
 		},
@@ -246,7 +246,7 @@ func TestStaticConnectors(t *testing.T) {
 					c.Name = "New"
 					return c, nil
 				}
-				return s.UpdateConnector(c2.ID, updater)
+				return s.UpdateConnector(ctx, c2.ID, updater)
 			},
 			wantErr: true,
 		},
@@ -257,13 +257,13 @@ func TestStaticConnectors(t *testing.T) {
 					c.Name = "New"
 					return c, nil
 				}
-				return s.UpdateConnector(c1.ID, updater)
+				return s.UpdateConnector(ctx, c1.ID, updater)
 			},
 		},
 		{
 			name: "list connectors",
 			action: func() error {
-				connectors, err := s.ListConnectors()
+				connectors, err := s.ListConnectors(ctx)
 				if err != nil {
 					return err
 				}