> - Offline token will never expire. Or should we eventually add another
> timeout for offline token (With some big default value like 1 month or so)?

It should never expire. Or at most, there should be a setting for the
realm/client that would allow the offline token to never expire. It can,
however, be revoked.