Question
Vodafone
IN
Last activity: 26 Aug 2020 7:48 EDT
OpenIDConnect- Refresh token questions
Hello team,
We came to know that pega does not support ootb to refresh the token in OpenID connect. Hence decided to make exclusive call to idp , just by passing client_id,secret ,grant_type and refresh token in token endpoint url
Issue #1 :
could observe below error while hitting token endpoint url
| pyStatusMessage | com.pega.pegarules.pub.services.OutboundMappingException: Could not acquire fresh access token |
What could be reason behind this error? Attached stack trace
Issue #2 :
I can decode access token using below API
String accessToken = oauth2Client.getAccessToken();
Do we have same for Refresh token as well pls? if not, how do i ensure that i am sending valid refresh token to idp. i need to decrypt it before sending it to IDP
Request your help on mitigating both issues. Thanks!!
***Moderator: Pallavi to add Support Case details***
Pegasystems Inc.
IN
Hi, Can you please elaborate on the use case here ? Are you looking to use tokens acquired during login in the subsequent application processing ?
Vodafone
IN
Hi bagas,
Thanks for your response. yes, i need to use refresh token for subsequent processing.
Use case: Pega invokes IDP for token and IDP shares token for which life team is 10 mins. Pega has to intiate refresh call to IDP by sending parameters(client id,secret,refresh_token and grant_type) in raw format(not sure of encoding method/algorithm) that pega uses.
by default, pega stores this in pr_data_access_token table in endoded format . Need help in decrypting the refresh token stored in pr_data_access_token table.
Please suggest here to acheive this requirements. Thanks !!
Please note : INC-141371 is raised with GCS team for this issue.
Pegasystems Inc.
IN
Hi,
If you want to use the same access token in subsequent REST calls, You can create an OAuth2 auth profile with authorization code grant type and use it in the connector. Same combination of scopes should be used (same order).Platform refreshes access token if its expired by the time you call the connector (if refresh token is returned in the initial call by IDP). Refresh token will not be available in plain text format for application layer. You can also refer to the below article on how to use this OAuth2 profile at runtime for connecting external web components protected by OAuth2. https://community.pega.com/knowledgebase/articles/user-interface/84/harness-and-section-forms-configuring-external-web-component-section
Thanks,
Santhosh
Vodafone
IN
Hi Santosh,
Thanks for your reply. Unfortunately auth profile of oauth type is not helping here. IDP team expects post call in below format to refresh the token
POST /token HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded client_id=************** &client_secret=some_***************** &grant_type=refresh_token &refresh_token=******************
Its of grant_type as 'Refresh token' string and refresh token should be in plain text format. Couple of questions
1. As IDP team is expecting grant_type as refresh token string, if i call idp for refresh token by hard coding above expeted parm with oauth profile as grant type , getting below error evenif i check 'use if refresh token available' checkbox
| pyStatusMessage | com.pega.pegarules.pub.services.OutboundMappingException: Could not acquire fresh access tokem |
what could be the work around to meet this requirement?
2. Does Platform refreshes the token by default? The reason behind this question is that we could see session is not ending even after token expires, just that its not calling idp. If yes, its not satifying oru client's security requirements of having long session
Pegasystems Inc.
IN
Platform refreshes access token using refresh token only when
- the token is used to invoke any REST service
- AT is expired.
- RT is available