Hello again @rueben.tiow,
The problem with the session id is that it is not necessarily unique across different authorizations (if a user authorizes twice without logging out in between, both authorizations would get the same session id).
From what I found, the event.refresh_token.id is the only value that can actually be used to distinguish two authorizations. Is there a way for me to access the event.refresh_token.id during the oidc-basic-profile action?
Alternatively, is there another action that can be triggered after exchange authorization code for access token so that in there I might be able to both write a custom claim onto the access token and read the id of the refresh token?
Thanks again