Invalid Grant using Refresh Token

[Henri Mikkonen]

Hi,

The logger for net.shibboleth.shared.security.DataSealer seems to 
produce following line on DEBUG:

DEBUG [net.shibboleth.shared.security.DataSealer:329] - Unwrapped data 
has expired

Note that DEBUG level may produce privacy-sensitive data to the logs.

FYI: I also filed OP-specific ticket for this: 
https://shibboleth.atlassian.net/browse/JOIDC-286

BR,
Henri.

On 24.8.2026 14.36, Florian Ritterhoff via users wrote:
> Hi Henri,
> 
> Out of curiosity, is there maybe some logging option we could set to debug to dig a bit into our current issue?
> 
> Thanks
> Flo
> 
>> On 24. Aug 2026, at 13:31, Henri Mikkonen <henri.mikkonen at nimbleidm.com> wrote:
>>
>> [Some people who received this message don't often get email from henri.mikkonen at nimbleidm.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>>
>> Hi,
>>
>> In addition to the corrupted token contents (which means that it cannot
>> be unsealed as you said), also the use of expired refresh token causes
>> similar log line.
>>
>> It'll be improved for the future release once the OP code exploits the
>> latest underlying APIs:
>>
>> https://shibboleth.atlassian.net/browse/JSSH-80
>>
>> BR,
>> Henri.
>>
>>
>> On 24.8.2026 13.54, Florian Ritterhoff via users wrote:
>>> Hi together,
>>>
>>> We are using OIDC + Refresh Tokens for some Apps. We irregularly see some strange InvalidGrant responses from the IDP without a real explanation. Is there any chance that we can debug that on our own and try to understand what’s going on here? From my understanding the only way to trigger the following message would be that the refresh token unsealing broke ...
>>>
>>> WARN [net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateGrant:349] - Profile Action ValidateGrant: Unwrapping refresh token failed
>>>
>>> Thanks
>>> Flo
>>>
>>>
>>
>> --
>> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
>