Auto Renew on fetch is not working

[hokonohara]

Describe the bug

Auto Refresh on fetch should return refreshed token, but it return error.
Related Tractus-X EDC Docs:
https://github.com/eclipse-tractusx/tractusx-edc/blob/main/docs/usage/management-api-walkthrough/07_edrs.md#auto-renew-on-fetch

To Reproduce

I use umbrella chart to deploy Data Exchange Subset in the link below.
https://github.com/eclipse-tractusx/tractus-x-umbrella/blob/main/docs/user/linux/README.md

And then follow the Testing the Data Exchange using bruno collection as below link:
https://github.com/eclipse-tractusx/tractus-x-umbrella/blob/main/docs/user/common/guides/data-exchange.md#1-bruno-collection

Everything work fine.
But if the token expired, and I rerun the 04-Get Authorization on Bruno 02-Consume_Data, (with the auto_refresh=true as documented on Tractus-X EDC docs above), I got the following error:

[
  {
    "message": "Could not execute token refresh: [signToken] Server response to [POST, http://ssi-dim-wallet-stub.tx.test/api/sts] was not one of [200, 201] but was 500: {\"type\":\"about:blank\",\"title\":\"Internal Server Error\",\"status\":500,\"detail\":\"InternalErrorException: Internal Error: Unsupported JWS algorithm RS256, must be ES256K\",\"instance\":\"/api/sts\",\"properties\":{\"timestamp\":1770484474784}}",
    "type": "InvalidRequest",
    "path": null,
    "invalidValue": null
  }
]

data consumer edc controlplace logs

│ {"timestamp":"2026-02-07T17:26:33.9261582","level":"DEBUG","message":"Token '91618437-c25a-4148-9f53-10e12e45d63d' expired, need to refresh."}                                                                                                                                       │
│ {"timestamp":"2026-02-07T17:26:33.9268322","level":"DEBUG","message":"DIM Token expired, need to refresh."}                                                                                                                                                                          │
│ {"timestamp":"2026-02-07T17:26:49.6112445","level":"ERROR","message":"HTTP client exception caught for request [POST, http://ssi-dim-wallet-stub.tx.test/api/sts]"}                                                                                                                  │
│ {"timestamp":"2026-02-07T17:27:21.9797747","level":"DEBUG","message":"[DataPlaneSelectorManagerImpl] DataPlaneInstance umbrella-dataconsumer-1-edc-dataplane is now in state AVAILABLE"}

Expected behavior

Expected to get the token, not error.

Screenshots/Error Messages

N/A

Context Information

N/A

• Used version: Current Umbrella Charts
• OS: Linux, Minikube

Possible Implementation

N/A

Others

Looking at the log, something related to Wallet Stub STS?

[hokonohara]

I also read the following docs:
DataPlane Signaling Token Refresh
https://github.com/eclipse-tractusx/tractusx-edc/blob/main/docs/development/dataplane-signaling/tx-signaling.extensions.md
Swagger API control plane edrs /refresh
https://eclipse-tractusx.github.io/tractusx-edc/openapi/control-plane-api/#/Control%20Plane%20EDR%20Api/refreshEdrV3
Swagger API data plane /token
https://eclipse-tractusx.github.io/tractusx-edc/openapi/data-plane-api/#/Token%20Refresh%20API/refreshToken

Not sure calling Data Provider directly by Consumer is a good idea, and I still can not done it with 200 return.
Also try the control plane /refresh, but I got the same error as the above message. API docs does not show how to pass the refresh token?

[arnoweiss]

Is there already an issue for this in the wallet stub? The flow works like this:

sequenceDiagram
    participant CC as Consumer Client (you)
    participant CCP as Consumer Control Plane
    participant CSTS as Consumer STS
    participant PDP as Provider Data Plane

    autonumber
    CC ->> CCP: GET /edrs/{{transferprocessid}}/dataaddress?auto_refresh=true
    CCP->>CSTS: signToken(oldAccessToken)
    CSTS-->>CCP: signed old access token
    CCP->>PDP: refresh(signedOldAccessToken, oldRefreshToken)
    PDP->>PDP: validate signatures<br/>correlate tokens<br/>
    PDP-->>CCP: new auth token, new refresh token
    CCP-->>CC: new auth token, new refresh token

Loading

The error you're getting originates in call 2 and 3. The error states that the Consumer STS (in this case the wallet stub) can't process tokens that are signed with RS256 but only with ES256K. I'm unsure which token this affects. Might be the signedOldAccessToken, oldAccessToken and the oldRefreshToken.

[hokonohara]

I talked with peoples on umbrella project. It seems they know the problem.
It is related to limitation of the wallet Stub implementation, and they said it worked with SAP DIV? DIM? product.
The solution might to patch the Stub (Thanks Arno for the comment above, that might be the case), but currently Identity Hub to replace Stub is being developed so the option is to wait for that.

[AndrYurk]

@hokonohara, the issue was created in the wallet stub repo, and the PR has already been prepared:
eclipse-tractusx/ssi-dim-wallet-stub#94