Currently tokens are cached with tenant id which issued them, this is an issue when "common" authority is used - cached AT will not be found during silent call, so RT will be used and redundant call to STS executed.