Add an OpenID Connect access token management companion package

[axies20]

Summary

Provide an Apache-2.0-licensed Open.IdentityServer companion package for ASP.NET Core OpenID Connect clients that automatically manages user access tokens and refresh tokens, serving the same use case as Duende.AccessTokenManagement.OpenIdConnect without requiring a Duende package dependency.

Suggested package name: Open.IdentityServer.AccessTokenManagement.OpenIdConnect (or another name consistent with this project's conventions).

Motivation

Applications migrating from Duende IdentityServer to Open.IdentityServer can remove their server-side Duende dependency, but may still rely on Duende.AccessTokenManagement.OpenIdConnect in their web clients to refresh user access tokens and attach them to outgoing HTTP requests.

Although that package is currently Apache 2.0 licensed, a project-owned alternative would provide long-term licensing and maintenance independence for the Open.IdentityServer ecosystem. The goal is an independently maintained implementation of the same workflow, not a dependency on or copy of Duende's package.

Reference implementation/use case: https://github.com/DuendeSoftware/foss/tree/main/access-token-management/src/AccessTokenManagement.OpenIdConnect

Proposed scope

• Integrate with ASP.NET Core OpenID Connect and cookie authentication.
• Read the current user's access token, refresh token, and expiry from the authentication session.
• Refresh an access token shortly before it expires and persist rotated access/refresh tokens back to the authentication session.
• Prevent concurrent requests for the same session from causing multiple refresh operations.
• Provide an HttpClient/delegating-handler integration that automatically attaches a valid bearer token.
• Support configurable refresh skew and error handling.
• Define clear behavior for missing, expired, revoked, or rejected refresh tokens (for example, clearing the invalid session or returning a typed result).
• Avoid logging or otherwise exposing access tokens, refresh tokens, or client secrets.
• Include dependency-injection registration, documentation, and an end-to-end sample using Open.IdentityServer.
• Publish the implementation as an independently versioned NuGet package under the project's open-source license.

Acceptance criteria

• A user-authenticated ASP.NET Core application can register the feature through DI and use an HttpClient that automatically receives a valid access token.
• An expiring access token is refreshed using the stored refresh token, including refresh-token rotation.
• Updated tokens and expiry are persisted to the authenticated session.
• Concurrent refreshes for one session are coordinated safely.
• Refresh failures have documented, predictable behavior and do not create retry loops.
• Unit and integration tests cover successful refresh, rotation, concurrency, missing tokens, and token-endpoint errors.
• Documentation includes setup, configuration, security guidance, and migration guidance from Duende.AccessTokenManagement.OpenIdConnect.

Would the maintainers consider this a suitable companion package for the Open.IdentityServer ecosystem?