NetSuite Custom Connector via OAuth 2.0

(0) Share

Report

Posted on by MiguelGR

I'm trying to create a REST Web Services custom connector to NetSuite, using the following security settings:

Identity Provider: Generic Oauth 2

Authorization URL: https://********.app.netsuite.com/app/login/oauth2/authorize.nl

Token URL: https://********.suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token

Refresh URL: https://********.suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token

Scope: rest_webservices

Redirect URL: https://global.consent.azure-apim.net/redirect

In NetSuite's side I created the necessary Oauth 2.0 role and integration. When I try to connect it opens a browser window for me to login to my user, and it correctly authenticates. The connection works for the first 60 minutes, but then Power Automate is supposed to refresh the token by using the Refresh URL, which is answered by NetSuite with a "BadRequest" error, followed by an "AccessTokenExpired" error. This can only be solved by manually re authenticating the connection in the browser, which is of course not practical.

I went through this issue with NetSuite's support but they seem to think it's a problem with Power Automate.

Has anyone been able to successfully keep the authentication working for more than 60 minutes?

Categories:

Using connectors

I have the same question (0)

All responses (25)

Answers (0)

abm abm 32,865 Most Valuable Professional on at

Like (0)

Report

Hi @MiguelGR

Interesting question? May I ask you why you got a process running more than 60 minutes?

Thanks

Was this reply helpful? Yes No
MiguelGR 21 on at

Like (0)

Report

@abm The issue happens when the flow is triggered after 60 minutes have passed since the initial browser authentication. This happens because OAuth 2.0 initially gives you a token that's valid for only 60 minutes. Then the client is supposed to use the refresh URL to get a new token. And that's when Power Automate get a BadRequest error. After that the flow stops working because the initial token is expired.

Was this reply helpful? Yes No
abm abm 32,865 Most Valuable Professional on at

Like (0)

Report

Hi @MiguelGR

My understanding is when the token expires you need to capture the error and request to the token endpoint using the refresh token it previously received, and will get back a new access token it can use to retry the original request.

To use the refresh token, make a POST request to the service’s token endpoint with grant_type=refresh_token, and include the refresh token as well as the client credentials.

The response will be a new access token, and optionally a new refresh token, just like you received when exchanging the authorization code for an access token.

Looks like you got a flow which using the connector and running for more than 60 minutes so that means you need to capture the error handling inside flow to get next request for the refresh token.

Reference: https://www.oauth.com/oauth2-servers/making-authenticated-requests/refreshing-an-access-token/

Thanks

Was this reply helpful? Yes No
MiguelGR 21 on at

Like (1)

Report

Thank you @abm, but I believe that would only be necessary if I was handling the OAuth2 authentication myself. But Power Automate supports OAuth2 natively, and takes care of refreshing the token from the service’s token endpoint.

Was this reply helpful? Yes No
abm abm 32,865 Most Valuable Professional on at

Like (0)

Report

Hi @MiguelGR

Agreed it should have been nice if it was automatically authenticates but looks like the error you are getting says that token is expired. If you compare with standard or signed third party connector might handle that. The custom connectors still have gaps compared to standard connectors. I have seen other posts related to standard vs custom connectors which some of the behaviours are different.

Alternate solution which I can think is capture the error handling in your next step and authenticate again. Is that a possibility?

Thanks

Was this reply helpful? Yes No
MiguelGR 21 on at

Like (1)

Report

@abm Unfortunately handling the error in the next step and trying to authenticate again just results on the same bad request error when the flow tries to refresh the token.

To clarify, the problem is not the token being expired. The problem is that NetSuite doesn't accept the flow's request to refresh the token, returning a bad request error. As a consequence the token it tries to use to authenticate is expired, but that's expected after failing to refresh it.

Was this reply helpful? Yes No
abm abm 32,865 Most Valuable Professional on at

Like (1)

Report

Hi @MiguelGR

Thanks for the update. Could you raise this with MS Support? Hopefully support could reveal more on this.

Thanks

Was this reply helpful? Yes No
ryanriss 6 on at

Like (1)

Report

I have raised the issue with MS Support, and mentioned that it could be a problem affecting all Generic OAuth 2 Identities.

Was this reply helpful? Yes No
bcampbell13 58 on at

Like (0)

Report

Any update on this?

Was this reply helpful? Yes No
ryanriss 6 on at

Like (0)

Report

I'm still going back and forth with support but I guess I reached the attention of a level 2 support person who is now evaluating my custom connector.

I don't know what they'll come back with, but maybe there's a bug in saving the refresh url on the security details page, or maybe they could come back with how to edit the Swagger2.0 Source Code. I feel like this error on refreshing the OAuth 2.0 token is either a problem that affects all generic OAuth2.0 connections, or it's a NetSuite problem. They are currently reviewing a couple HAR files from my browser console to see what the request looks like after the token expired.

Was this reply helpful? Yes No