diff --git a/components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.java b/components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.java index de7b62efd5..3bd372f3e5 100644 --- a/components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.java +++ b/components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.java @@ -523,7 +523,11 @@ protected String signJWT(JWTClaimsSet jwtClaimsSet, if (JWSAlgorithm.RS256.equals(signatureAlgorithm) || JWSAlgorithm.RS384.equals(signatureAlgorithm) || JWSAlgorithm.RS512.equals(signatureAlgorithm) || JWSAlgorithm.PS256.equals(signatureAlgorithm)) { - return signJWTWithRSA(jwtClaimsSet, tokenContext, authorizationContext, isRefreshToken); + if (isRefreshToken) { + return signJWTWithRSA(jwtClaimsSet, tokenContext, authorizationContext, true); + } + // Call the 3-arg overload for non-refresh tokens (access tokens) to preserve subclass override behavior. + return signJWTWithRSA(jwtClaimsSet, tokenContext, authorizationContext); } else if (JWSAlgorithm.HS256.equals(signatureAlgorithm) || JWSAlgorithm.HS384.equals(signatureAlgorithm) || JWSAlgorithm.HS512.equals(signatureAlgorithm)) { return signJWTWithHMAC(jwtClaimsSet, tokenContext, authorizationContext);