indigo-iam / iam

INDIGO Identity and Access Management Service
https://indigo-iam.github.io/
Other
99 stars 43 forks source link

Concurrent RT requests raise 500 HTTP error #728

Open federicaagostini opened 3 months ago

federicaagostini commented 3 months ago

When the client performs concurrent refresh token flows and the previously issued access token is deleted (i.e. the box Clear access tokens on refresh for that client is checked), IAM returns 500 server error.

IAM log shows that it is due to a db transaction deadlock during the deletion of the already issued access token:

[EL Warning]: 2024-01-03 14:05:25.363--UnitOfWork(1883820979)--Exception [EclipseLink-4002] (Eclipse Persistence Services - 2.7.9.v20210604-2c549e2208): org.eclipse.persistence.exceptions.DatabaseException
Internal Exception: com.mysql.cj.jdbc.exceptions.MySQLTransactionRollbackException: Deadlock found when trying to get lock; try restarting transaction
Error Code: 1213
Call: DELETE FROM token_scope WHERE EXISTS(SELECT id FROM access_token WHERE (refresh_token_id = ?) AND id = token_scope.owner_id)
bind => [1 parameter bound]
Query: DeleteAllQuery(name="OAuth2AccessTokenEntity.deleteByRefreshToken" referenceClass=OAuth2AccessTokenEntity sql="DELETE FROM access_token WHERE (refresh_token_id = ?)")

The error disappears when the box Clear access tokens on refresh is unchecked for that client.