The client admin modal offers token-lifetime fields for standard (manually created) OAuth clients and a RefreshTokenUsage setting. These are persisted into the client settings dictionary (modgud:access_token_lifetime, modgud:identity_token_lifetime, modgud:absolute_refresh_token_lifetime, modgud:sliding_refresh_token_lifetime, modgud:refresh_token_usage — see OAuthAdminMapping.cs) but no OpenIddict handler ever reads them, so they have no effect.
Only DCR/CIMD-registered clients and native-grant lifetimes use the effective OpenIddict-native tkn_lft:* keys (bounds-validated).
Either wire the standard-client fields to the tkn_lft:* enforcement path (with the same bounds validation) or remove them from the admin UI so the UI does not suggest configurability that does nothing.
The client admin modal offers token-lifetime fields for standard (manually created) OAuth clients and a
RefreshTokenUsagesetting. These are persisted into the client settings dictionary (modgud:access_token_lifetime,modgud:identity_token_lifetime,modgud:absolute_refresh_token_lifetime,modgud:sliding_refresh_token_lifetime,modgud:refresh_token_usage— seeOAuthAdminMapping.cs) but no OpenIddict handler ever reads them, so they have no effect.Only DCR/CIMD-registered clients and native-grant lifetimes use the effective OpenIddict-native
tkn_lft:*keys (bounds-validated).Either wire the standard-client fields to the
tkn_lft:*enforcement path (with the same bounds validation) or remove them from the admin UI so the UI does not suggest configurability that does nothing.