Refresh token not refreshing post 8-10 hrs

Appflow persistent

Hi,

We are working on a module and we have found that the tokens are not refreshing after 8 hrs which is causing out pipeline failure and hampering our deployments.

We need to understand why is this happening.

Thanks.

For direct approach feel free to approach us at-

manju_palat@persistent.com

radhika_edlabadkar@persistent.com

Alex Wong

@Manoj Bhosale
auth token is only available for 60 minutes

refresh token is good for 365 days.

auth token is used for making SKY API calls, refresh token is used to get new auth token.

are you talking about your refresh token is not allowing you to get new auth token after 8-10hrs?

I have a scheduled task that refresh my auth token using refresh token every 59 minutes, and it has been running for more than 1 year now no issue (except when BB server had issue).

Appflow persistent

@Alex Wong
Yes, refresh token get expired after 7-8 hours and not able to generate new access token. Let me provide you more detail. We have 5 flows each has different set of token pair generated with different client application but with similar account/user.

Is there any possibility refresh token revoked due to one user has multiple client applications and trying to refresh token and conflicting leads to refresh token revocation ?

Can preserve refresh token approach help here ?

Alex Wong

@Manoj Bhosale
I don't believe multiple set of auth token/refresh token is a problem. @Erik Leaver @Ben Wong maybe able to provide some additional light

However, I don't use this model. I have 1 set of auth token/refresh token set. This one set of token is stored confidentially in a safe location on SharePoint, which a separete automation run a refresh every 59 minutes, this refresh will push out the refresh expire date and store the auth token. Before any other automation may use the auth token stored, it will check the “expiration” date first (which is also stored when refresh happens) and if expired, will call the refresh automation to do a refresh first. This is to ensure that refresh automation may have a glich and failed to do refresh

Ben Wong

Thanks for the tag and providing great directions, @Alex Wong. @Manoj Bhosale if you have multiple concurrent processes that are performing the OAuth 2.0 flow, then it's likely that you're invalidating the refresh tokens when the first one is used. Preserving the refresh token should help with this but you should be rotating the refresh token regularly (daily, weekly, monthly) otherwise you run the risk of it expiring after 365 days.

Hope that helps!

Appflow persistent

Thank you for response @Ben Wong

Could you please take a look on below queries.

If concurrent oAuth flow cause invalid refresh token,

1. how it works for 7-8 hours and then started failing?
2. What are the options to achieve 5 flows works with different set of tokens and prevent refresh token become invalid. Because in our use case 5 flows can run concurrently and we have separate module for each to maintain token specific to flow. This is the reason we are using different set of token pairs so refreshing token for one flow do not impact on another flow. But looks this approach is not helping here.

Could you help.

Appflow persistent

Thanks for response @Alex Wong
Posted couple of questions here, if you have any inputs please suggest

Bryce Howard

@Manoj Bhosale
“prevent refresh token become invalid.” Not when you are issued a new refresh token and have the old token revoked https://datatracker.ietf.org/doc/html/rfc6749#section-6

The authorization server MAY issue a new refresh token, in which case the client MUST discard the old refresh token and replace it with the new refresh token. The authorization server MAY revoke the old refresh token after issuing a new refresh token to the client.

The fact that it's happening after 7-8 hours, makes it seem like a collision during refresh or some cumulative effect. How are you storing the tokens (shared database, separate files, etc.)? Do all 5 processes refresh around the same time when their 60-minute access tokens expire?

If you are developing in React you can use mutex's async concurrent token renewal processes. I personally use python where I designate one process as the token manager that all other applications connect through.

Ben Wong

@Manoj Bhosale If you have separate flows happening, with 5 different refresh tokens, then you don't need to preserve the refresh token since each token will have it's own expiration and each can be rotated without affecting the other.

Here are some common issues with authorization that you can check out:

Alex Wong

@Manoj Bhosale
why use 5 sets of auth token/refresh token? why not all process uses same set of auth/refresh token?