Need help understanding what mod_auth_openidc does and doesn't do

[javo397]

I inherited a web-based project from someone who is no longer with the company, and I've been struggling for the last several months to get a grasp on how the mod_auth_openidc module is supposed to work and exactly what it's supposed to be doing. I suspect it's just not configured correctly, or there's something missing entirely, but the project has so many layers (Apache, Django, REST API, React, SSL, Azure ID, access tokens, OpenID Connect, etc.), it's hard to know what I need to change to fix issues as they arise.

I have a general understanding of what mod_auth_openidc is (a module that enables authentication to help protect the site), but I'm not sure I understand what it's actually supposed to do. All it currently seems to be doing is timing out user sessions, which causes the website to hang due to failures, which requires users to manually refresh the browser every morning before they can use it again. I have a configuration file where I can change OIDC settings, but users just keep running into issues if the site is kept open long enough.

Starting with a couple basic questions:

1. Should session management be handled automatically with this module? When a user session times out, should the user be getting automatically logged out and/or redirected to a login page? I can increase session timeouts with OIDCSessionInactivityTimeout and OIDCSessionMaxDuration, but that doesn't address the fact that it will eventually time out, and users have to maually refresh the browser (and in some cases have to log out and back in to regain access). I have not had much luck finding examples online of how to handle this part of the process.
2. Should refreshing of access tokens be happening automatically with this module, or does that need to be managed separately? Again, there appear to be some settings for this, such as OIDCRefreshAccessTokenBeforeExpiry, but this is apparently not supported on my current version. Currently, I'm having to refresh access tokens separately from the module, but again, everything eventually times out and refreshes start failing, and the user has to manually refresh the page.

[zandbelt]

See also here: https://github.com/zmartzone/mod_auth_openidc/wiki/Sessions-and-Timeouts