Make it possible to specify the refresh token expiration in the OAuth2AccessTokenResponse

[Seregy]

Expected Behavior

I'd like to be able to customize the refreshToken in the OAuth2AccessTokenResponse by specifying a refresh token expiration value. OAuth2AccessTokenResponse.Builder could expose a method to optionally set the expiration for a refresh token.

Current Behavior

OAuth2AccessTokenResponse.Builder always constructs an OAuth2RefreshToken instance with the null expiresAt value and doesn't allow to customize this behavior.

Context

The authorization server I'm using provides the refresh_token_expires_in parameter along with the access and refresh tokens during the authorization code grant flow. I'd like to get this value from the OAuth2RefreshToken for further processing within the application. As the refresh_token_expires_in is not a standard parameter, I was going to use a custom access token response converter instead of the DefaultMapOAuth2AccessTokenResponseConverter one to extract the refresh token expiration value from the response. Unfortunately, OAuth2AccessTokenResponse.Builder uses the OAuth2RefreshToken constructor without the expiresAt parameter and doesn't provide a way to set the refresh token expiration.

[sjohnr]

@Seregy thanks for reaching out!

In OAuth2AccessTokenResponse there is additionalParameters which is intended for custom parameters like this. This refresh token expiration is not needed by Spring Security (since it is off-spec), so it doesn't really make sense to add it to the builder. However, the DefaultMapOAuth2AccessTokenResponseConverter does populate additionalParameters, and I believe the custom refresh_token_expires_in should show up there. If not, would you mind adding a minimal, reproducible sample so I could take a look?