Clarification required: Authorization/Authentication tokens

[ralfbayer-db]

Regarding the OAUTH Tokens used for authentication and authorisation, we require some clarifications

• The OSDM Provider's IDM will provide pairs of access token/refresh token
• They will be JWTs (JSON Web Tokens) (at least the access token)
• The token endpoint will return the expiry time of the access token in the standard way
• An OSDM Consumer can request and use multiple sets of access/refresh tokens for the same IDM account in parallel (to support distributed/parallelized consuming services). In particular, requesting a new token pair from the IDM does NOT invalidate previously issued tokens which have not yet expired

[CGantert345]

might be covered by JWT - to be checked

[schlpbch]

Addressed in documentation.