7

I am performing a rest callout to a 3rd party service. Authentication is set up with a named credential (Named Principal, OAuth2) using an Open ID Connect-authentication provider which uses WSO2 identity server.

Initially, callouts from apex code work fine, until the token expires after 24hrs. Then I am consistently receiving below error:

{"message":"unauthorized request, please refresh your access token","statusCode":401,"error":"Unauthorized"}

Named credentials

Auth Provider The only "workaround" is to start the OAuth Flow again using the "Start Authentication Flow on Save"-setting in the named credential.

Does anybody have an idea what the issue could be? This question is similar to question( Named Credential - Automatic refresh token does not work with WSO2 Identity server) but no response on that question too?

Improve this question
5
  • This seems to be expected behavior. Have you confirmed this with the service provider as how long the token is valid? If its valid for 24 hours, then you will need to fetch the token again and make the callout. Are you fetching the token prior of it expiring?
    – Jayant Das
    Jan 31, 2019 at 2:06
  • 2
    Hi Jayant, Expected Behavior of named credentials with openid auth provider is as: After setting up the named credential successfully by performing the OAuth flow initially, the platform feature encapsulates all further handling with refresh tokens etc from the user. So once the token is expired it should fetch the new refresh token automatically when it receive 401 error.
    – rahul gupta
    Jan 31, 2019 at 7:53
  • 1
    Unless you have defined the Scope attribute as refresh_token. Is the Scope attribute configured this way in your Named Credential configuration?
    – Jayant Das
    Jan 31, 2019 at 14:10
  • Thanks Jayant for the response. I have added screenshots of my configurations and I am using refresh_token scope in named credentials but it's still not working. After 24 hours once access token expires, its returning {"message":"unauthorized request, please refresh your access token","statusCode":401,"error":"Unauthorized"} error.
    – rahul gupta
    Feb 2, 2019 at 11:13
  • @rahulgupta Did you ever get resolution? I'm also unable to get this working with wso2.
    – Jason Clark
    May 23, 2022 at 13:47

3 Answers 3

Reset to default
2

In the Named Credential you should set Scope to refresh_token.

enter image description here

Improve this answer
2

I believe (based on a discussion with a client who uses WSO2) that the default config for WSO2 generates Refresh Tokens which expire after 24 hours. So long as you make an API call after the Access Token expires (I believe 1 hour by default, and listed in the auth response if you proxy the auth traffic, see below) but before the Refresh Token expires (24 hours), you should be okay. But if you ever have a period over 24 hours in which no callouts are made, your refresh token will be invalid when the next callout invokes a refresh token request. One possible workaround is to run a scheduled job multiple times per day to make some request via the Named Credential, to ensure the refresh token never expires before it is used. Some additional information can be found in in this answer.

Improve this answer
1

In my case i had use Scope as refresh_token full

If we just use refresh_token then the endpoint will not allow us to call API

Note that the order of scope is also important.

enter image description here

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .