OIDC extension: refresh and validate endpoints?

[Wessel, Keith]

Thanks, all. Sounds like the short answer to introspection is to be on the look-out for the production release of 1.1.0.

One more question based on what Liam brought up: what property controls the storage service to use for refresh tokens? I don’t see a storage setting for this in idp-oidc.properties. I only see dynamic registrations, remote JWK sets, and the revocation cache which, obviously, all must be server-side.

Keith


From: users <users-bounces at shibboleth.net> On Behalf Of Liam Hoekenga
Sent: Wednesday, August 28, 2019 11:43 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: OIDC extension: refresh and validate endpoints?

Refresh tokens are sent to the token endpoint to obtain a new access token.

refresh tokens do work.  I believe the client needs to access for the "offline_access" scope, and be permitted the "refresh_token" grant.

Apparently, there's an issue with the 1.0.x extension's handling of client side storage - https://github.com/CSCfi/shibboleth-idp-oidc-extension/issues/25#issuecomment-505594481
I would think you might want server side storage anyway, if you were planning on using refresh tokens, otherwise, I don't think you could revoke them administratively?
 
For "validate", are you interested in the Introspection endpoint?  Not being terribly knowledgeable about the operations of the extension, it looks to me like it probably needs to be added to the OP metadata template:
https://github.com/CSCfi/shibboleth-idp-oidc-extension/blob/1cb253121d82ced9ce6c283fbd1f9ce88e46e64e/roles/oidc-extension/templates/openid-configuration

The Introspection endpoint requires "master" from GIT (which identifies itself as 1.1.0 SNAPSHOT, but is not tagged that way).
We have 1.1.0-SNAPSHOT in one of our non-prod environments and the endpoint appears to be working as expected.

Liam