OIDC extension: refresh and validate endpoints?

[Liam Hoekenga]

>
> Refresh tokens are sent to the token endpoint to obtain a new access token.
>

refresh tokens do work.  I believe the client needs to access for the
"offline_access" scope, and be permitted the "refresh_token" grant.

Apparently, there's an issue with the 1.0.x extension's handling of client
side storage -
https://github.com/CSCfi/shibboleth-idp-oidc-extension/issues/25#issuecomment-505594481
I would think you might want server side storage anyway, if you were
planning on using refresh tokens, otherwise, I don't think you could revoke
them administratively?


> For "validate", are you interested in the Introspection endpoint?  Not
> being terribly knowledgeable about the operations of the extension, it
> looks to me like it probably needs to be added to the OP metadata template:
>
> https://github.com/CSCfi/shibboleth-idp-oidc-extension/blob/1cb253121d82ced9ce6c283fbd1f9ce88e46e64e/roles/oidc-extension/templates/openid-configuration
>

The Introspection endpoint requires "master" from GIT (which identifies
itself as 1.1.0 SNAPSHOT, but is not tagged that way).
We have 1.1.0-SNAPSHOT in one of our non-prod environments and the endpoint
appears to be working as expected.

Liam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190828/ed3b6915/attachment.html>