using idp.oauth2.refreshToken.activation

[Bergmann, Clemens]

Hi,

we have a client (roundcube using SASL XOAUTH2 over SMTP) that needs to
use a refresh token.

We don't want to use "offline_access" in this case because the user is
present [1] and we dont't want to show attribute release consent on
each login.

The Documentation [2] states that idp.oauth2.refreshToken.activation
can be set to define own conditions on sending an refreh token.

My goal is to always send a RefreshToken to this client and respond to
all other clients like before.

I tried to make this as modular as possible by adding a tag in the
clients metadata and defining the following bean in global.xml:

<bean id="TuDaRefreshTokenActivationCondition"
parent="shibboleth.Conditions.OR">
    <constructor-arg>
        <list>
            <ref bean="DefaultRefreshTokenActivationCondition" />
            <bean parent="shibboleth.Conditions.EntityDescriptor">
                <constructor-arg name="pred">
                    <bean
parent="shibboleth.Conditions.MappedEntityAttributes">
                    <constructor-arg>
                        <list>
                        <bean parent="shibboleth.TagCandidate"
                           
c:name="https://idp.hrz.tu-darmstadt.de/attributes/forceRefreshToken"
                            p:values="true" />
                        </list>
                    </constructor-arg>
                    </bean>
                </constructor-arg>
            </bean>
        </list>
    </constructor-arg>
</bean>

Unfortunately this way the bean could not defined during IdP-
Initalization because of "Cannot resolve reference to bean
'DefaultRefreshTokenActivationCondition'".

I tried to set ' lazy-init="true"' on the bean and that solved the
problem for the IdP-init when the bean is first used the same error is
shown.


Now my question:
Has anyone successfully used the idp.oauth2.refreshToken.activation
property? 


[1] https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess
[2]
https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2931327005/OPToken


Mit freundlichen Grüßen
Clemens (Bergmann)

-- 
Clemens Bergmann
[er/ihm; he/him]
Team Linux/Team IDM
Technische Universität Darmstadt
Hochschulrechenzentrum, Alexanderstraße 2, 64283 Darmstadt
Tel. +49 6151 16 71184
Matrix: @cb50tory:matrix.tu-darmstadt.de
http://www.hrz.tu-darmstadt.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6229 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20260515/92f4a2d4/attachment.p7s>