Invalid Grant using Refresh Token

[Florian Ritterhoff]

Hi together,

We are using OIDC + Refresh Tokens for some Apps. We irregularly see some strange InvalidGrant responses from the IDP without a real explanation. Is there any chance that we can debug that on our own and try to understand what’s going on here? From my understanding the only way to trigger the following message would be that the refresh token unsealing broke ...

WARN [net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateGrant:349] - Profile Action ValidateGrant: Unwrapping refresh token failed

Thanks
Flo

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4507 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20260824/24637475/attachment.p7s>