Experience with OIDC plugin

[Janne Lauros]

>Shouldn't they be just be short lived and assumed to be issued with a user having logged in to produce them?

 I had to revisit the specification. The way I read chapter 11. about offline_access scope the presence of the user must be checked when accessing UserInfo endpoint unless offline_access scope has been requested. I guess there is no way around it. I will ask about it. That leaves still open if we achieve that (or anything) by trying to locate the session id of the authenticated user at that point.


    "offline_access
        OPTIONAL. This scope value requests that an OAuth 2.0 Refresh Token be issued that can be used to obtain an Access Token that grants access to the End-User's UserInfo Endpoint even when the End-User is not present (not logged in)."

 BR Janne