OIDC access/refresh token changes with OIDC OP v4?

[Wessel, Keith]

I've been thinking along these lines, too, Scott. We did the upgrade on Thursday, but numbers didn't increase in the IdP logs for access token rejections until Sunday/Monday, which, it being summer, could be excuseable due to people being out on Friday. But it could also signify something changing on the app side.

Out of curiosity, what would we see in the IdP log if the client requested a new access token using the refresh token? And more importantly, would what also would we see if the IdP said the refresh token was invalid? I'm trying to find evidence, as you suggested, that the refresh token is even being used and, if so, what the results are. I've been searching the OP source to find log messages to this affect but haven't been able to.

The only thing we know is that, since Monday, we've been receiving reports of people (not everyone just some people) needing to sign back into the app more frequently.

Keith


-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: Thursday, August 22, 2024 4:30 PM
To: Shib Users <users at shibboleth.net>
Cc: Wessel, Keith <kwessel at illinois.edu>
Subject: Re: OIDC access/refresh token changes with OIDC OP v4?

> p:accessTokenLifetime="P1D"

You mentioned people having to sign in "daily", but so far as I was able to tell, that's what you're telling that Apache module to do if you set the access token to last a day.

My guess is that the refresh token behavior isn't what you think it is and that it's not able to refresh the access token or thinks it can't, and so that expires the session.

I would be digging into that end before focusing on the OP, see what it thinks is happening when it tries to refresh the access token. If it even is. That's not default behvaior I don't believe.

This assumes the more obvious explanation is ruled out, that the data sealer keystores are out of sync. I am fairly sure the Apache module will toss the whole session if that refresh token call ever fails.

-- Scott