Reasonable values for access token and refresh token lifetimes?

[Wessel, Keith]

Hi, all,

An app developer on our campus is asking us to increase the Shibboleth OIDC access token and refresh token lifetimes to 1 day and 1 month respectively. These are obviously much higher than the rather conservative defaults that ship with the OIDC extension.

Being quite new to OIDC, I thought I'd ask those on this list who might have been at it longer than a month or three... Are those reasonable defaults?

I also presume I can change these on a per-client basis, but I don't see anything in the OIDC extension docs on how to do this. Is there a way?

Thanks,
Keith