<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Jim,<div class=""><div><br class=""><blockquote type="cite" class=""><div class="">Does the refresh token carry within it enough information for the IdP to issue a new id token? Or is there a permanent cache needed somewhere?</div></blockquote><br class=""></div></div><div>Yes: all the needed information is encoded inside the refresh_token (which is encrypted via data sealer). Depending on your attribute-resolver configuration, also the attribute/claim values might be included [1].</div><div><br class=""></div><div>There’s no need (actually not even support at the moment) for any server-side cache/storage regarding them.</div><div><br class=""></div><div>BR,</div><div>Henri.</div><div><br class=""></div><div>[1] <a href="https://github.com/CSCfi/shibboleth-idp-oidc-extension/wiki/AttributeEncoderPluginConfiguration" class="">https://github.com/CSCfi/shibboleth-idp-oidc-extension/wiki/AttributeEncoderPluginConfiguration</a></div></body></html>