OIDC OP 3.4 and issueIdTokenViaRefreshToken

[Wessel, Keith]

Hi, all,

Scott, thanks for your earlier guidance on the refresh token chain lifetime. We think that took care of expiring refresh tokens, but as soon as we got that fixed, we encountered a new problem. Our refresh tokens were no longer returning a new ID token along with the access token. This was without enabling the oauth2.token flow and thus using the implicit settings for the oidc.sso flow.

We added the oauth2.token flow to the override for this client and, with it, added all of the settings we already had for the oidc.sso flow. I left them in place for both flows to be safe. In addition, for the oauth token flow, I also explicitly set p:issueIdTokenViaRefreshToken="true". That's supposed to be the default, but before I enabled the token flow, there was no ID token. After enabling that flow with the explicit setting of true (I didn't try without explicitly setting that property), there was an ID token.

I didn't see an available issueIdTokenViaRefreshToken property for the OIDC SSO flow. Adding the token flow was the only way I could figure out to enable this.

Could there be a bug in the default value for this property when implicitly set in the OIDC SSO flow? It definitely returned an ID token in 3.3.0 without enabling the token flow. I can file a bug if you like.

Thanks,
Keith