Any changes in OIDC RP overrides between V1 and V2?

[Jim Fox]

I tested this on a 4.1 install and it works just like my v2(oidc) prod 
hosts.  I only tested the access token lifetime, as my mod_auth_openidc 
reports that token's lifetime.  However, the 'P1D' is not acceptable.  It 
seems to have to be 'PT24H'.

Jim

On Mon, 29 Mar 2021, Wessel, Keith wrote:

> Date: Mon, 29 Mar 2021 09:20:18
> From: "Wessel, Keith" <kwessel at illinois.edu>
> To: "users at shibboleth.net" <users at shibboleth.net>
> Reply-To: Shib Users <users at shibboleth.net>
> Subject: Any changes in OIDC RP overrides between V1 and V2?
> 
> Hi, all,
>
> Our V4 IdP running V2 of the OIDC extension doesn't seem to be honoring overridden token lifetime values the way they were being overridden in IdP V3. I have yet to confirm that there's not something else at fault. But I just wanted to make sure that the below config fragment in relying-party.xml will work the same in IdP V4.0.1  and OIDC extension V2 as it did in the previous versions:
>        <bean parent="RelyingPartyByName" p:responderIdLookupStrategy-ref="profileResponderIdLookupFunction" c:relyingPartyIds="#{{(client IDs go here)}}">
>            <property name="profileConfigurations">
>                <list>
>                    <bean parent="OIDC.SSO" p:accessTokenLifetime="P1D"
> 			p:iDTokenLifetime="P1D" p:refreshTokenLifetime="P1Y" />
> 		    <bean parent="OIDC.UserInfo"/>
> 		    <bean parent="OAUTH2.Revocation"/>
>                </list>
>            </property>
>        </bean>
>
> If that's correct, any guidance on troubleshooting further? Is the token expiration time presented to the client with the token?
>
> Keith
>
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>