OidcClient has failed to complete the refresh_token grant request: "error_description":"Refresh token expired"

[tttomat19]

Describe the bug

It seems like there's no processing of expired refresh_tokens implemented. So "refresh token expired" error appears and oidc-client is unable to get new access_token.

Expected behavior

OidcClient could have some refresh_token processing logic.

1. Test refresh_token for being expired
2. If true , get new refresh_token, await
3. If got new refresh_token, then get new access_token

Actual behavior

oidc-client is unable to get new access_token with stale refresh_token , and refresh_token itself is not requested.

How to Reproduce?

rest-client + oidc-client (via OidcClientRequestFilter) + keycloak 12hrs refresh_token exp.

https://github.com/tttomat19/quarkus-quickstarts/tree/main/rest-client-quickstart

Output of uname -a or ver

No response

Output of java -version

No response

GraalVM version (if different from Java)

No response

Quarkus version or git rev

No response

Build tool (ie. output of mvnw --version or gradlew --version)

No response

Additional information

No response

[quarkus-bot]

/cc @pedroigor, @sberyozkin

[sberyozkin]

@tttomat19 I think the grant request has to be repeated if RT has expired - it is already done if AT has expired but no RT is available - so the condition here needs to be tweaked a bit - if AT has expired then do a new grant request if no RT is available or RT has expired.
The problem is, there is no standard RT expiry property - RT is supposed to be long-lived. If it is in a JWT format then it can be deduced but there is no chance for a binary RT which is the case in most cases.
As such I'd not qualify it as a bug. I guess we can add a new property to check the RT expiry time - assuming the provider you are dealing with returns such a property

[sberyozkin]

I see this is Keycloak, should be fine