<div dir="ltr"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Refresh tokens are sent to the token endpoint to obtain a new access token.</div></div></blockquote><div><br></div><div>refresh tokens do work.  I believe the client needs to access for the "offline_access" scope, and be permitted the "refresh_token" grant.</div><div><br></div><div>Apparently, there's an issue with the 1.0.x extension's handling of client side storage - <a href="https://github.com/CSCfi/shibboleth-idp-oidc-extension/issues/25#issuecomment-505594481">https://github.com/CSCfi/shibboleth-idp-oidc-extension/issues/25#issuecomment-505594481</a></div><div>I would think you might want server side storage anyway, if you were planning on using refresh tokens, otherwise, I don't think you could revoke them administratively?</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">For "validate", are you interested in the Introspection endpoint?  Not being terribly knowledgeable about the operations of the extension, it looks to me like it probably needs to be added to the OP metadata template:<br><a href="https://github.com/CSCfi/shibboleth-idp-oidc-extension/blob/1cb253121d82ced9ce6c283fbd1f9ce88e46e64e/roles/oidc-extension/templates/openid-configuration" target="_blank">https://github.com/CSCfi/shibboleth-idp-oidc-extension/blob/1cb253121d82ced9ce6c283fbd1f9ce88e46e64e/roles/oidc-extension/templates/openid-configuration<br></a></div></blockquote><div><br></div><div>The Introspection endpoint requires "master" from GIT (which identifies itself as 1.1.0 SNAPSHOT, but is not tagged that way).</div><div>We have 1.1.0-SNAPSHOT in one of our non-prod environments and the endpoint appears to be working as expected.</div><div><br></div><div>Liam</div></div></div>