Use tofu token from controller (#3064)

* initial commit

CHANGELOG.md

@@ -19,6 +19,7 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
   credential type. [PR](https://github.com/hashicorp/boundary/pull/2989)
 * ui: Fix credential library not saving correctly when trying to save it as a
   generic secrets type. ([PR](https://github.com/hashicorp/boundary-ui/pull/1640))
+* sessions: Fix tofu token retreival. ([PR](https://github.com/hashicorp/boundary/pull/3064))
 
 ## 0.12.0 (2023/01/24)
 

internal/daemon/worker/session/session.go

@@ -214,10 +214,17 @@ func (s *sess) GetLocalConnections() map[string]ConnInfo {
 	return res
 }
 
+// Return local tofu token, if availble; otherwise return the tofu token from the resp
 func (s *sess) GetTofuToken() string {
 	s.lock.RLock()
 	defer s.lock.RUnlock()
-	return s.tofuToken
+	if len(s.tofuToken) > 0 {
+		return s.tofuToken
+	}
+	if s.resp != nil {
+		return s.resp.GetTofuToken()
+	}
+	return ""
 }
 
 func (s *sess) GetConnectionLimit() int32 {