Symptom:

Create a user account.
Authenticate using oauth and allow access to the oauth client.
Request a refresh token.
Delete the user account.
Attempt to use the refresh token.

Result:

EntityMetadataWrapperException: Unable to get the data property name as the parent data structure is not set. in EntityStructureWrapper->getPropertyValue() (line 438 of /sites/all/modules/entity/includes/entity.wrapper.inc).

As long as clients continue to request refresh token for this token, it will throw exceptions.

Cause:

Exception stack trace points back to:
oauth2_server/Storage::getRefreshToken() line 203:
'user_id' => $token_wrapper->user->name->value(),

When a user account is deleted the rows in the oauth2_server_token table for that user still exit.

The token is fetched (successfully) from the database however the $token_wrapper->user is NULL because the user no longer exists. Exception thrown.

CommentFileSizeAuthor
#1 oauth2_server-cancel-user-account-2258195-2.patch544 bytesaaronaverill
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

aaronaverill’s picture

aaronaverill CreditAttribution: aaronaverill commented
FileSize
oauth2_server-cancel-user-account-2258195-2.patch544 bytes

Fix for issue: delete token row associated with user when the user's account is canceled.

aaronaverill’s picture

aaronaverill CreditAttribution: aaronaverill commented
Status: Active » Needs review
bojanz’s picture

bojanz CreditAttribution: bojanz commented
Status: Needs review » Needs work

We need to use entity_delete() since tokens are entities.

pjcdawkins’s picture

pjcdawkins CreditAttribution: pjcdawkins at Centarro commented
Status: Needs work » Fixed

I've committed a fix. Thanks @aaronaverill

  • pjcdawkins committed 68fbd41 on 7.x-1.x 
    Issue #2258195 by aaronaverill: Delete tokens when the associated user...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.