OIDC OP 3.4 and issueIdTokenViaRefreshToken

[Wessel, Keith]

If it defaults to false if the profile is OIDC SSO, then yes, that's a change in behavior that's either undocumented or a bug, take your pick. And I'll definitely start using the token flow now, both for this override and in my default configuration, as well.

One question: if I'm overriding things (access token lifetime, ID token lifetime, refresh token chain lifetime) for the OIDC SSO profile, do I also need to override those for the oauth token profile?

Keith


-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: Monday, July 31, 2023 5:47 PM
To: Shib Users <users at shibboleth.net>
Cc: Wessel, Keith <kwessel at illinois.edu>
Subject: Re: OIDC OP 3.4 and issueIdTokenViaRefreshToken

> Could there be a bug in the default value for this property when implicitly
> set in the OIDC SSO flow? It definitely returned an ID token in 3.3.0 without
> enabling the token flow. I can file a bug if you like.

The logic derives a value of false if the active profile configuration isn't the expected type.

I guess that's a bug, but the ability to leave out the token profile bean is largely a compatibility thing, it was meant to be temporary and would eventually probably be disallowed.

-- Scott