search

CAAPIM / Android-MAS-SDK

Install and use the Mobile SDK for Android™
Other
14 stars 22 forks source link

Update clearAccessToken method #374

Open dnys1 opened 4 years ago

dnys1 commented 4 years ago

Issue

Calling the MssoContext.clearAccessToken method clears all keys in the private token storage. If this is done while a valid refresh token is present but a valid ID token is not, the next refresh call, which will default to using the ID token, will fail.

Changes

This MR introduces a separate method clearAccessAndRefreshTokens for the cases where both token types should be cleared from the private token storage, and changes the current implementation of clearAccessToken to clear only the access token while leaving the refresh token intact.

The logic in AccessTokenAssertion.findAccessToken is also updated for the case where the access token has been cleared, but a valid refresh token is available. The library should first try to update with the refresh token before reverting to the ID token.

dnys1 commented 4 years ago

Thank you @graju256. I did look at all calls to clearAccessToken but had to make an educated guess of the intention (whether to clear access and refresh or just access). A double check on this would be great. Thanks!