don't reset session on reauthentication

lib/open_project/openid_connect/sso_logout.rb

@@ -7,6 +7,20 @@ module OpenProject
         super || id_token_expired?
       end
 
+      ##
+      # Upon reauthentication just return directly with HTTP 200 OK
+      # and do not reset the session.
+      # If not call super which will reset the session, set
+      # the new user, and redirect to some page the script the
+      # reauthentication doesn't care about.
+      def successful_authentication(user)
+        if reauthentication? user, id_token
+          render text: 'reauthenticated'
+        else
+          super
+        end
+      end
+
       def logout
         if params.include? :script
           logout_user
@@ -24,6 +38,10 @@ module OpenProject
           super
         end
       end
+
+      def reauthentication?(user, id_token)
+        id_token && user.identity_url.ends_with?(":#{id_token.sub}")
+      end
     end
   end
 end