OIDC access/refresh token changes with OIDC OP v4?

[Henri Mikkonen]

On 23.8.2024 3.37, Wessel, Keith via users wrote:
> Out of curiosity, what would we see in the IdP log if the client requested a new access token using the refresh token? And more importantly, would what also would we see if the IdP said the refresh token was invalid? I'm trying to find evidence, as you suggested, that the refresh token is even being used and, if so, what the results are. I've been searching the OP source to find log messages to this affect but haven't been able to.

A successful use of a refresh token will produce an audit log line from 
the token endpoint, with message types TokenRequest and 
OIDCTokenResponse. With the default audit configuration, that line is 
similar to the ones which you see during the SSO sequence right after 
the authorize-endpoint call.

When the refresh token is not accepted, the ValidateGrant class is 
logging on warning level. For example:

2024-08-23 06:41:40,088 - WARN 
[net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateGrant:322] - 
Profile Action ValidateGrant: Unwrapping refresh token failed
2024-08-23 06:41:40,100 - WARN 
[org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed event 
occurred while processing the request: InvalidGrant

BR,
Henri.