OIDC refresh token timeout and revocation cache lifetime

[Wessel, Keith]

Never heard back on this, but it seems like I've run into an issue.

On 3.3, we had:

                    <bean parent="OIDC.SSO" p:accessTokenLifetime="P1D"
                        p:iDTokenLifetime="P1D"
                        p:refreshTokenLifetime="P365D" />
...
                    <ref bean="OAUTH2.Revocation"/>

That worked fine.

With 3.4, I updated to:

                    <bean parent="OIDC.SSO" p:accessTokenLifetime="P1D"
                        p:iDTokenLifetime="P1D"
                        p:refreshTokenTimeout="P365D" />
...
                    <bean parent="OAUTH2.Revocation"
                        p:revocationLifetime="P365D" />

And I'm getting reports that refresh tokens from a few days ago aren't being honored.

What's the correct way in 3.4 to reproduce the refresh token validity period that I was uing in 3.3?

Any help appreciated.

Keith



-----Original Message-----
From: Wessel, Keith 
Sent: Friday, July 21, 2023 11:37 AM
To: users at shibboleth.net
Subject: OIDC refresh token timeout and revocation cache lifetime

Hi, all,

In moving from the OIDC OP plugin V3.3.0 to 3.4.0, I'm trying to figure out the changes around the refresh token validity properties.

1. First, since the previous refreshTokenLifetime is listed as deprecated, can I assume I can continue to use it in the short term with V3.4.0 with, at most, a warning, but everything else will continue to function as-is? And none of the changes related to revocation cache that I ask about below come into play? Just looking for a clean migration path.

2. If I switch to refreshTokenTimeout, the wiki is quite clear that I need to make sure my revocation cache lifetime is at least as long as the refresh token lifetime. We've got a couple of mobile apps with longer refresh token lifetimes. If I set the revocationLifetime option in the same configuration override (or metadata-driven configuration) for that client, will that just change the revocation cache lifetime for auth tokens for those clients? I'd like to leave it at 6 hours for the vast majority of clients but up it to a longer value for those mobile clients. I assume that'll work, but I wanted to make sure.

Keith