search

openid / AppAuth-iOS

iOS and macOS SDK for communicating with OAuth 2.0 and OpenID Connect providers.
https://openid.github.io/AppAuth-iOS
Apache License 2.0
1.77k stars 773 forks source link

access token refresh with refresh token #349

Open benpallen opened 5 years ago

benpallen commented 5 years ago

I try to refresh an expired access token using the "performActionWithFreshTokens" method in OIDAuthState. I currently use 1.0.0 beta version of AppAuth. I have the same issue on 0.0.95 version too.

When I called the method, I get the following response from Keycloak server. { "error": "invalid_grant", "error_description": "Refresh token expired" }

But the problem is that the completion handler is not getting called for "dataTaskWithRequest" method in OIDAuthorizationService. (Line:292 ) NSURLSession session = [OIDURLSessionProvider session]; [[session dataTaskWithRequest:URLRequest completionHandler:^(NSData _Nullable data, NSURLResponse _Nullable response, NSError _Nullable error) {

WilliamDenniss commented 5 years ago

I think I need some more info here. If the completion handler on the token refresh isn't being called, how do you know what the error message is for the token refresh?

Can you provide some more detailed logs? Define _APPAUTHTRACE and AppAuth will output more logs.

chcsdickerson commented 5 years ago

I am also encountering this issue. Pod- AppAuth 0.95.0

Code excerpt (if that helps): Code_OIDC signin flow.txt

I can easily reproduce by:

  1. Open app
  2. Sign in
  3. Save OIDServiceConfiguration and OIDAuthState to db (encrypted)
  4. Close app
  5. Wait till access token expiry time has elapsed
  6. Open app
  7. Read in OIDServiceConfiguration and OIDAuthState from db
  8. Send request using performActionWithFreshTokens:

AppAuth logging:

`2019-03-18 17:08:08.213799-0400 ...[15392:411979] Token Request: https://.../oauth2/token

Headers:{ "Content-Type" = "application/x-www-form-urlencoded; charset=UTF-8"; }

HTTPBody: refresh_token=ddb15ee3-9556-3997-a9a8-125f0f7371d8&client_id=klYTntXLIruu8MnVpyesCS7kXtIa&grant_type=refresh_token

2019-03-18 17:08:08.848909-0400 ...[15392:412045] Token Response: HTTP Status 400 HTTPBody: {"error_description":"Persisted access token data not found","error":"invalid_grant"}`

chcsdickerson commented 5 years ago

I think this is caused by SFSafariViewController not retaining my IdP's cookie (containing client's IdP session id) over restarting app.

UPDATE

Nevermind my ramblings. Turns out my problem was I hadn't saved the refreshed tokens, so I attempted to refresh tokens with a already-used refresh token.

Thank you to all the contributors of AppAuth. Appreciate all your hard work.

markusfassbender commented 5 years ago

@chcsdickerson So this issue can be closed?

benpallen commented 5 years ago

Yes Thank you

On Apr 17, 2019, at 10:49 AM, Markus notifications@github.com<mailto:notifications@github.com> wrote:

@chcsdickersonhttps://github.com/chcsdickerson So this issue can be closed?

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHubhttps://github.com/openid/AppAuth-iOS/issues/349#issuecomment-483976665, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AVFJbOxEiVk0WiRGr-wzGaGxGvwHuwzmks5vhtITgaJpZM4aH_Dd.

fukemy commented 3 years ago

I think this is caused by SFSafariViewController not retaining my IdP's cookie (containing client's IdP session id) over restarting app.

UPDATE

Nevermind my ramblings. Turns out my problem was I hadn't saved the refreshed tokens, so I attempted to refresh tokens with a already-used refresh token.

Thank you to all the contributors of AppAuth. Appreciate all your hard work.

hello, same problem like u, i want to force refresh token anytime when user open app, but the 2nd time the refresh_token does not saved into oauth, then i got error invalid_grant in 3rd call updating, when i checked in server, it's return "can not find refresh_token matched", can.u provide some ways that u solved this? Thanks

youssefmyh commented 3 years ago

Hello, we are facing this issue a lot with IOS 15 any suggestion on how we can avoid it

we can easily reproduce it by following this scenario :

Thanks in advance