Profile config flag refreshTokensEnabled not honored by the token flow
Basics
Logistics
Basics
Logistics
Description
The profile configuration flag/predicate for enabling refresh tokens is not honored by the token flow. The refresh tokens are thus issued if the RP metadata and the requested scope permit issuance, even though the profile config would deny it.
Modified the ValidateGrant action to not allow refresh_token grants when refresh tokens are disabled in the profile configuration.
Henri MikkonenMarch 17, 2022 at 10:28 AM
Added an activation condition for the SetRefreshTokenToResponseContext action: the action is run only if the profile configuration flag for refresh tokens is enabled.
The profile configuration flag/predicate for enabling refresh tokens is not honored by the token flow. The refresh tokens are thus issued if the RP metadata and the requested scope permit issuance, even though the profile config would deny it.