#NEWLINE# def _refresh_access_token_endpoint( self , req , **kwargs ) : #NEWLINE# #INDENT# _sdb = self . sdb #NEWLINE# _log_debug = logger . debug #NEWLINE# client_id = str ( req [ 'client_id' ] ) #NEWLINE# client_info = self . cdb [ client_id ] #NEWLINE# assert ( req [ 'grant_type' ] == 'refresh_token' ) #NEWLINE# rtoken = req [ 'refresh_token' ] #NEWLINE# try : #NEWLINE# #INDENT# _info = _sdb . refresh_token ( rtoken , client_id = client_id ) #NEWLINE# #UNINDENT# except ExpiredToken : #NEWLINE# #INDENT# return self . _error ( error = 'access_denied' , descr = 'Refresh token is expired' ) #NEWLINE# #UNINDENT# if ( ( 'openid' in _info [ 'scope' ] ) and ( 'authn_event' in _info ) ) : #NEWLINE# #INDENT# userinfo = self . userinfo_in_id_token_claims ( _info ) #NEWLINE# try : #NEWLINE# #INDENT# _idtoken = self . sign_encrypt_id_token ( _info , client_info , req , user_info = userinfo ) #NEWLINE# #UNINDENT# except ( JWEException , NoSuitableSigningKeys ) as err : #NEWLINE# #INDENT# logger . warning ( str ( err ) ) #NEWLINE# return self . _error ( error = 'access_denied' , descr = 'Could not sign/encrypt id_token' ) #NEWLINE# #UNINDENT# sid = _sdb . access_token . get_key ( rtoken ) #NEWLINE# _sdb . update ( sid , 'id_token' , _idtoken ) #NEWLINE# #UNINDENT# _log_debug ( ( '_info: %s' % _log_debug ) ) #NEWLINE# atr = AccessTokenResponse ( ** by_schema ( AccessTokenResponse , ** _info ) ) #NEWLINE# logger . info ( ( 'access_token_response: %s' % atr . to_dict ( ) ) ) #NEWLINE# return Response ( atr . to_json ( ) , content = 'application/json' )