Any changes in OIDC RP overrides between V1 and V2?

[Wessel, Keith]

One more theory with this issue that I wanted to run past those who know the code better than me. If the data sealer key that was the current secret when the refresh token was generated is no longer available to the IdP, will the IdP refuse the refresh token? Or does the data sealer have nothing to do with the refresh token? We've reduced the number of refresh tokens we're keeping around, and I wondered if that could be the problem. We never kept a year's worth, but we kept more than we are now.

I did change the refresh token lifetime to P365D instead of P1Y and am waiting to hear if that made a difference, but based on what Jim said, I'm not expecting it to act any differently than P1Y.

Keith


-----Original Message-----
From: Wessel, Keith 
Sent: Monday, March 29, 2021 12:47 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: Any changes in OIDC RP overrides between V1 and V2?

Well, that's a bummer as I thought I had the cause of this one figured out. Jim, is there a way of telling the expiration time on an access token or a refresh token without cranking up the IdP logging? Is this part of the response to the client when the token is issued?

Keith

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Jim Fox
Sent: Monday, March 29, 2021 12:36 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Any changes in OIDC RP overrides between V1 and V2?


>
> Month/Day/Year values are before, Hour/Minute/Second is after, just as in an ISO timestamp. It's the same syntax, just a P in front of it and that some values don't represent unambiguous durations. I doubt months or years work for example.
>

Actually, p:accessTokenLifetime="P1Y" worked just fine.  It gave me a year from tomorrow though: Tue Mar 29 10:31:06 2022

Jim

--
For Consortium Member technical support, see https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/x/coFAAg__;!!DZ3fjg!sqp88LNy4VWdVhLWvnLxiOiUO0ZcMRriZRqXdkujZesTNqSBS_hJTJn2fqljR290jQ$
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net