From 1821cb4631865ee824a683a6bb6eb111cf3714b4 Mon Sep 17 00:00:00 2001
From: Irena Rindos <irenarindos@users.noreply.github.com>
Date: Wed, 8 Mar 2023 13:49:57 -0500
Subject: [PATCH] Use tofu token from controller (#3064)

* initial commit
---
 CHANGELOG.md                              | 1 +
 internal/daemon/worker/session/session.go | 9 ++++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 433fe747b6..ebe1ba1164 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
   credential type. [PR](https://github.com/hashicorp/boundary/pull/2989)
 * ui: Fix credential library not saving correctly when trying to save it as a
   generic secrets type. ([PR](https://github.com/hashicorp/boundary-ui/pull/1640))
+* sessions: Fix tofu token retreival. ([PR](https://github.com/hashicorp/boundary/pull/3064))
 
 ## 0.12.0 (2023/01/24)
 
diff --git a/internal/daemon/worker/session/session.go b/internal/daemon/worker/session/session.go
index 69b4da6cf6..61283bc651 100644
--- a/internal/daemon/worker/session/session.go
+++ b/internal/daemon/worker/session/session.go
@@ -214,10 +214,17 @@ func (s *sess) GetLocalConnections() map[string]ConnInfo {
 	return res
 }
 
+// Return local tofu token, if availble; otherwise return the tofu token from the resp
 func (s *sess) GetTofuToken() string {
 	s.lock.RLock()
 	defer s.lock.RUnlock()
-	return s.tofuToken
+	if len(s.tofuToken) > 0 {
+		return s.tofuToken
+	}
+	if s.resp != nil {
+		return s.resp.GetTofuToken()
+	}
+	return ""
 }
 
 func (s *sess) GetConnectionLimit() int32 {