OIDC access/refresh token changes with OIDC OP v4?

[Cantor, Scott]

> p:accessTokenLifetime="P1D"

You mentioned people having to sign in "daily", but so far as I was able to tell, that's what you're telling that Apache module to do if you set the access token to last a day.

My guess is that the refresh token behavior isn't what you think it is and that it's not able to refresh the access token or thinks it can't, and so that expires the session.

I would be digging into that end before focusing on the OP, see what it thinks is happening when it tries to refresh the access token. If it even is. That's not default behvaior I don't believe.

This assumes the more obvious explanation is ruled out, that the data sealer keystores are out of sync. I am fairly sure the Apache module will toss the whole session if that refresh token call ever fails.

-- Scott