OIDC access/refresh token changes with OIDC OP v4?

[Wessel, Keith]

Hi, all,

We (finally) upgraded to IdP v5 last week, and all went very well aside from some pesky token issues with a mobile app that has long-lived access tokens and extremely long-lived refresh tokens. Same app I've run into issues and talked about here on the list before. We're seeing:

[net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl.ParseAccessToken:126] - Profile Action ParseAccessToken: Unable to parse/decode token for validation

Just before that in the log, we see the IdP successfully retrieving the correct data sealer key version to decode the token. But then it fails to decode.

I know that some new functionality is available in 4.1.0 for custom refreshtoken encoding/decoding, but I assume that left at the defaults, this is unchanged from previous versions.

Did anything change between v3 and v4 of the plugin that could have caused our IdP to no longer be able to decode these tokens?

Furthermore, some users are reporting that they have to sign back in multiple days in a row. So, it's almost as if the refresh tokens are no longer being honored at all.

Oddly, other users have had no problems at all. I, for one, have yet to be prompted to sign back in.

Any thoughts on where we might start investigating this or on things that changed that could be a source of the issue?

Thanks,
Keith