How to configure mod_auth_openidc to support a forced reauthentication ("silent relogin") using max_age=0?

[bison-rmc]

There is a use case to fullfil a "silent-relogin" (like https://auth0.com/docs/authenticate/login/max-age-reauthentication#max_age-authentication-request-parameter). This means a user is alread successfully authenticate but should trigger a new login flow.

Note that

• this is not a use case for step-up authentication
• no logout should be triggered, as the logout will be forwarded to the external idp also
• we'd like to use the "max_age" param, as specified in https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
• Both tokens for the AS "ProductIDP" and AS "ExternalIDP" should be updated/renewed, so a single tokenrefresh triggered from the RP to the AS ProductIDP will not be sufficent as the "ExternalIDP" token will not be refreshed until it is outdated

Here is the use case in detail:

  ####                                                                                                            
  Silent-Relogin                                                                                                  
  ####                                                                                                                  
                         max_age=0                                                                                
                                                                                                                  
 +-----------+        Client Identifier        +- -------------+                                 +---------------+
 |          -+----(A)-& Redirection URI   ---->|               |                                 |               |
 |   User-   |        & User re-authenticates  | Authorization |                                 | Authorization |
 |   Agent   |                                 |     Server    |                                 |     Server    |
 |           |                                 |               |<-(a')Authorization-Code-Flow--->|               |
 |          -+----(B)-- Authorization Code ---<|   ProductIDP  |                                 |  ExternalIDP  |
 +--|----|---+                                 |               |           Client                |               |
    |    |                                     |               |         product-idp             |               |
    |    |                                     +---------------+                                 +---------------+
    |    |                                         ^      v                                                       
   (A)  (C)                                        |      |                                                       
    |    |                                         |      |                                                       
    ^    v                                         |      |                                                       
+ -----------+                                     |      |                                                       
|            |>--(C)-- Authorization Code ---------'      |                                                       
|    Client  |         & Redirection URI                  |                                                       
|            |                                            |                                                       
|main-product|<--(D)----- Access Token -------------------'                                                       
+------------+      (w/ Optional Refresh Token)                                                                             


(A/B) UserAgent initiates a new reloging on the Client. Client is passing the parameter "max_age=0" to the AS "ProductIDP". User re-authenticates automatically (using session cookies)
(a')Based on the max_age=0 param, AS ProductIDP initiates a silent reloging on the AS ExternalIDP (with normal auth-code flow)
(B)/(C)/(D) normal Authorization Code Flow steps

We use this pattern already with https://github.com/auth0/express-openid-connect as RP.

There is a fork which demonstrates a running example of the silent relogin using express-openid-connect and two Keycloak realms:

• https://github.com/bison-rmc/auth0-express-webapp-sample/blob/feature/silent-relogin/01-Login/README.md#running-this-sample-locally
• Silent-Relogin: https://github.com/bison-rmc/auth0-express-webapp-sample/blob/feature/silent-relogin/01-Login/routes/index.js#L13
• Keylcoak realms for ProductIDP and ExternalIDP: https://github.com/bison-rmc/auth0-express-webapp-sample/tree/feature/silent-relogin/01-Login/keycloakRealms

We would like to use the same strategy using mod_auth_openidc.
Is a silent relogin supported and if yes, how can we configure the silent-relogin case?