identityserver-token-lifecycle

Refresh token rotation in Duende IdentityServer is configured by setting token lifecycle policies that enforce sliding expiration, issuing a new token on each use while invalidating the old one to enhance security.

RFC 8693 token exchange allows Duende IdentityServer to issue new tokens for impersonation or delegation scenarios, exchanging an existing access token for a new one with different scopes or claims tailored to the downstream service.

IProfileService claims customization in Duende IdentityServer allows you to inject, filter, or transform claims into identity and access tokens during token issuance, tailoring token content to specific client or API security requirements.

Extension grants using IExtensionGrantValidator are needed when standard OAuth flows are insufficient, enabling Duende IdentityServer to support custom token exchange or non-standard authentication mechanisms for specialized interoperability.

Identity tokens authenticate the user and contain profile claims, while access tokens authorize API access. Managing their token lifecycles in Duende IdentityServer involves setting distinct lifetime policies and expiration behaviors for each type.

Yes, token exchange for delegation is supported in production-ready Duende IdentityServer setups. It uses RFC 8693 and extension grants to safely pass user context securely across downstream API boundaries.