OIDC InvalidGrant errors

[Mohamed Lrhazi]

I am setting up my first OIDC config and after it started working for a few
days, several users report that it suddenly stopped working. I find the
following in the log:

ERROR [net.shibboleth.utilities.java.support.security.DataSealer:252] -
Exception unwrapping data: Tag mismatch!
ERROR [org.geant.idpextension.oidc.profile.impl.ValidateGrant:179] -
Profile Action ValidateGrant: Obtaining authz code failed Exception
unwrapping data
WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event
occurred while processing the request: InvalidGrant
DEBUG [net.shibboleth.idp.profile.impl.RecordResponseComplete:89] - Profile
Action RecordResponseComplete: Record response complete
"POST /idp/profile/oidc/token HTTP/1.1" 400 61

These users are using a mobile app which uses the PKCE flow.

What could cause such errors? am guessing the token becomes invalid at some
point, but then the app should just get a new one?

Thanks!
Mohamed.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210302/8ca8a8b8/attachment.htm>