1
votes

We have an MVC application that uses IdentityServer4 as a STS. We have set the access_token and identity_token lifetime to four hours on the Client properties in the STS. We have also added the scope offline_access in our MVC client.

How do we refresh the access_token and/or the identity_token from the STS in the MVC client?

What could work, but I don't see this as a good solution is request a new token on every request. Should we keep track of this time in the MVC client and call something like: https://github.com/IdentityServer/IdentityServer4.Samples/blob/293622b8438d27f4c9c2574e43fe92a22560ac6b/Clients/src/MvcHybrid/Controllers/HomeController.cs#L46 Or is there some event that we can hook up to and request the new token(s)?

1

1 Answers

2
votes

You don't refresh identity tokens - only access tokens.

There is no event - either refresh tokens pro-actively based on expiration time - or wait until the API returns a 401 and refresh lazily.