OIDC access/refresh token changes with OIDC OP v4?

[Wessel, Keith]

Just wanted to circle back on this. Henri, thanks for the detailed messages to look for in the log. And Scott, I believe you're correct that this was something on the app side, or possibly the users' devices. After a few days, the app team stopped getting these prompts to sign back in. And, though it happened to several technical members of the app team and a hand full of end users, it wasn't widespread. Whatever it was cleared itself up.

Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Henri Mikkonen
Sent: Friday, August 23, 2024 1:49 AM
To: users at shibboleth.net
Subject: Re: OIDC access/refresh token changes with OIDC OP v4?

On 23.8.2024 3.37, Wessel, Keith via users wrote:
> Out of curiosity, what would we see in the IdP log if the client requested a new access token using the refresh token? And more importantly, would what also would we see if the IdP said the refresh token was invalid? I'm trying to find evidence, as you suggested, that the refresh token is even being used and, if so, what the results are. I've been searching the OP source to find log messages to this affect but haven't been able to.

A successful use of a refresh token will produce an audit log line from 
the token endpoint, with message types TokenRequest and 
OIDCTokenResponse. With the default audit configuration, that line is 
similar to the ones which you see during the SSO sequence right after 
the authorize-endpoint call.

When the refresh token is not accepted, the ValidateGrant class is 
logging on warning level. For example:

2024-08-23 06:41:40,088 - WARN 
[net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateGrant:322] - 
Profile Action ValidateGrant: Unwrapping refresh token failed
2024-08-23 06:41:40,100 - WARN 
[org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed event 
occurred while processing the request: InvalidGrant

BR,
Henri.
-- 
For Consortium Member technical support, see https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!DZ3fjg!45p2TDtHCl6sa3rN4jwhdNm-2AupFmtiVXxV3fERTa6q7OHYBqx2sLuhHdtHTzoB6FkBjA9Pd6BiEU_rpC0Zqjn5Lf9WJw$ 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net