/SASLogon/oauth/token: Invalid token (approvals expired)

[AllanBowe]

I'm running the following code as part of the mv_registerclient macro for creating web services as described here.

proc http method='POST'
in="grant_type=refresh_token&refresh_token=&REFRESH_TOKEN" out=&FILEREF
url='localhost/SASLogon/oauth/token' WEBUSERNAME="&CLIENT_ID" WEBPASSWORD="&CLIENT_SECRET" AUTH_BASIC;
headers "Accept"="application/json" "Content-Type"="application/x-www-form-urlencoded";
run;

This code has worked perfectly for at least 6 months, in a number of different Viya environments.  However today it threw:

{"error":"invalid_token","error_description":"Invalid token (approvals expired)"}

I generate a new client_id and client_secret every time I run the code, as I'm mainly doing demos or working with fresh installs.  What could be the issue?

[JuanS_OCS]

Hi Allan / @AllanBowe 

Interesting. As you might know, the token in an OAuth2 kind of token, therefore, it can be printed as JSON . Have you tried that?

Reason for me asking is because it is relatively common and well known: https://www.oauth.com/oauth2-servers/making-authenticated-requests/refreshing-an-access-token/

This can help you to get better control on token expiration mechanics.

The other possibility that comes to my mind is that there is a deeper issue in that system, which could invalidate tokens unexpectedly. For this is harder to provide guidance, as it could be given by time zone change, time change, updates (OS and/or SAS), etc.

Nonetheless, curl is your friend 🙂 As thumb rule: "Take things out of SAS, validate, then bring them back to SAS". Remove variables from the equation, then look at the logs.

[AllanBowe]

I tried it again today, and it worked.  Must have been a critter in a circuitboard somewhere 🙂

[JuanS_OCS · Accepted solution]

Oh, the story of our life 🙂

Great to hear!

You did well, not feeding him after midnight