OAuth APM as Authorisation server
Got a question I can't seem to get answered.
I have a OAuth authorisation server setup. I have applied the oauth profile and I have a per session policy that use oauth authroization to assign claims and scopes.
The claims are setup based upon session variables.
So the JWT created have 5 in life for access token and 60 min life for refresh token.
So at 5min +1 my client/resource server will access the auth server for a new access token using the refresh token.
I see this on the APM logs on the auth server and the client/resource server.
BUT on the auth server, there is no session alive ! so which auth server session variables is it using.
Does it just use the values that were assigned when the original request was made if thats the case.
How can I . if possible update the information for each request ?
Is it possible