'OIDC extend IDP session
We are migrating from the IAM (netiq) where for each protected url once it is hit will automatically extend IAM session. That way if IAM session timeout is 30 min and user is active for the first 15 min and then inactive for the next 25 the session is still active, since from the last protected call (via IAM) 30 min has not passed.
A problem arises now when we try to migrate to OIDC standard.
The way it works right now is this:
- on initial handshake (redirects) between OP and user agent (browser)
- we get session and are able to retrieve user info, plus our middle tier (spring boot) generates bearer token for the client to be used for access middle tier services directly with requests protected with this bearer token
the problem is that from the point that user logged in there in nothing that can say to OP that I am still active and to extend my current session. I googled quite a lot and can't find any relevant explanation on this topic.
Does OIDC support extending IDP session at all? if not then is there some way to mimic our existing functionality to extend IDP session on each call to the middle tier?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|