Unanswered

generic oAuth 2.0: Refresh token rotation

(0) Share

Report

Posted on by IndraDeMesmaeke

Hello,

we have been working on a custom connector for some time and have had some issues with token refreshing. We have setup the connector to use generic oAuth 2.0, retrieving access tokens and a refresh token works for an initial period.

Access tokens are also refreshed regularly. However, we have token rotation and expiry enabled on our refresh tokens every 2 weeks. After this point access tokens are no longer refreshed for the connector, our identity provider includes a new refresh token when the current refresh token is exchanged for renewed access.

Does a custom connector (and the built-in authentication) support rotation of refresh tokens, or does it expect the refresh token to be valid indefinitely?

Many thanks

Categories:

Connector development

I have the same question (0)

All responses (3)

Answers (0)

JBadham95_TT 2 on at

Like (0)

Report
Copy link

Link copied!

Hi,

Did you ever find a solution to this?

Thanks.

Was this reply helpful? Yes No
apdams 2 on at

Like (0)

Report
Copy link

Link copied!

I have the same question. Did you ever solve this. I have the same problem. My tokens refresh for as long as the refresh token is valid (588000 seconds ~ 6.8 days). After 7 days, I have to manually refresh the token in order to get a new refresh token.

Was this reply helpful? Yes No
IndraDeMesmaeke 29 on at

Like (0)

Report
Copy link

Link copied!

We ended up using a non-rotating refresh token and set up an inactivity expiration that was sufficiently long for our users. Not really the solution we were looking for, but it allowed us to continue.

Was this reply helpful? Yes No