topic Re: /SASLogon/oauth/token: Invalid token (approvals expired) in Developers

/SASLogon/oauth/token: Invalid token (approvals expired)

AllanBowe — Fri, 05 Jun 2020 00:31:47 GMT

I'm running the following code as part of the mv_registerclient macro for creating web services as described here.

proc http method='POST'
in="grant_type=refresh_token&refresh_token=&REFRESH_TOKEN" out=&FILEREF
url='localhost/SASLogon/oauth/token' WEBUSERNAME="&CLIENT_ID" WEBPASSWORD="&CLIENT_SECRET" AUTH_BASIC;
headers "Accept"="application/json" "Content-Type"="application/x-www-form-urlencoded";
run;

This code has worked perfectly for at least 6 months, in a number of different Viya environments. However today it threw:

{"error":"invalid_token","error_description":"Invalid token (approvals expired)"}

I generate a new client_id and client_secret every time I run the code, as I'm mainly doing demos or working with fresh installs. What could be the issue?

Re: /SASLogon/oauth/token: Invalid token (approvals expired)

JuanS_OCS — Thu, 05 Mar 2020 16:05:52 GMT

Hi Allan / @AllanBowe

Interesting. As you might know, the token in an OAuth2 kind of token, therefore, it can be printed as JSON . Have you tried that?

Reason for me asking is because it is relatively common and well known: https://www.oauth.com/oauth2-servers/making-authenticated-requests/refreshing-an-access-token/

This can help you to get better control on token expiration mechanics.

The other possibility that comes to my mind is that there is a deeper issue in that system, which could invalidate tokens unexpectedly. For this is harder to provide guidance, as it could be given by time zone change, time change, updates (OS and/or SAS), etc.

Nonetheless, curl is your friend 🙂 As thumb rule: "Take things out of SAS, validate, then bring them back to SAS". Remove variables from the equation, then look at the logs.

Re: /SASLogon/oauth/token: Invalid token (approvals expired)

AllanBowe — Fri, 06 Mar 2020 09:06:27 GMT

I tried it again today, and it worked. Must have been a critter in a circuitboard somewhere 🙂

Re: /SASLogon/oauth/token: Invalid token (approvals expired)

JuanS_OCS — Fri, 06 Mar 2020 09:16:39 GMT

Oh, the story of our life 🙂

Great to hear!

You did well, not feeding him after midnight