Bug: DCR endpoint not allowing an absolute_refresh_token_lifetime of 0

[Steve-Smith-Altium]

Currently the DCR endpoint responds with an error if the absolute_refresh_token_lifetime is set to 0, but according to the docs, a value of 0 is valid and allows an indefinite sliding refresh token expiration window. The DCR endpoint should therefore allow an absolute_refresh_token_lifetime value of 0, or set the value to 0 in the client if no absolute_refresh_token_lifetime has been set in the DCR request and the refresh_token_expiration is Absolute.

[khalidabuhakmeh]

Hello @Steve-Smith-Altium. I've confirmed a mismatch between the documentation and the code logic for setting this value. I am confirming with the development team which side is incorrect before moving forward. I will keep you updated with any new information.

[khalidabuhakmeh]

@Steve-Smith-Altium Hi Steve. We have confirmed this is a bug. Could you also let us know which version of IdentityServer you are currently using?

[Steve-Smith-Altium]

Thanks @khalidabuhakmeh. Looks like we're using version 7.2.4 of IdentityServer currently, but it also looks like it would be an issue with the latest version in the codebase.

[khalidabuhakmeh]

We have a fix for IdentityServer v7 and v8 in our codebase and will release it as soon as we can. Thank you for letting us know. The package numbers will be 8.0.3 and 7.4.8. We have some migration guides on our documentation to help with upgrading from 7.2.4 to 7.4 (https://docs.duendesoftware.com/identityserver/upgrades/v7_2-to-v7_3/). Start here.

[khalidabuhakmeh]

@Steve-Smith-Altium, while we have you, would you be so kind as to describe the use case you and your organization are using for DCR, and if there's anything we could do to improve the experience?