Reasonable values for access token and refresh token lifetimes?

[Cantor, Scott]

On 8/28/19, 4:52 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

> Regardless of that, does anyone know the answer to my second question? Does the OIDC extension to Shib allow for
> overriding refresh/access token lifetime values on a per-client basis?

I'm fairly certain the profile configuration beans that would be added to relying-party.xml have those settings.

Source specifically, https://github.com/CSCfi/shibboleth-idp-oidc-extension/blob/master/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/config/OIDCCoreProtocolConfiguration.java

There are lifetime settings there for all of these things.

-- Scott