In my own lab environment I had to disable opaque tokens and enable jwt (14.1).
The following is roughly what it looks like
apm profile oauth oauth-oidc-profile {
app-service none
audience none
client-apps {
oauth-oidc-client { }
}
id-token-primary-key myrsa
issuer https://issuer.example.com
jwt-refresh-token-enc-key [redacted]
jwt-token enabled
opaque-token disabled
openid-connect enabled
primary-key myrsa
resource-servers {
oauth-api-rs { }
}
userinfo-primary-key myrsa
}
Results in
{
"access_token": "ewog...NifA",
"expires_in": 300,
"token_type": "Bearer",
"scope": "openid",
"refresh_token": "nrY...i62",
"id_token": "ewog...LUCA"
}