Refresh token when using ClientCredentials or ResourceOwnerCredentials [#3038230]

The Client Credentials and Resource Owner grants needs to also use the refresh token when their tokens has expired

Currently only the Authorization Code grant is generating a new token using the refresh token if token has expired. This patch will also have the Client Credentials and Resource Owner grants make use of the refresh token.

Comment	File	Size	Author
#2	3038230-resource-owner-and-client-credentials-use-refresh-token.patch	2.1 KB	jagermonster

Comments

Comment #1

7 March 2019 at 10:05

jagermonster created an issue. See original summary.

Comment #2

jagermonster commented 7 March 2019 at 10:10

Status	File	Size
new	3038230-resource-owner-and-client-credentials-use-refresh-token.patch	2.1 KB

Comment #3

ivan.chavarro commented 29 October 2019 at 02:03

I got this error when I tried to use this patch:
BadMethodCallException: Required parameter not passed: "refresh_token" in League\OAuth2\Client\Grant\AbstractGrant->checkRequiredParameter() (line 35 of /app/vendor/league/oauth2-client/src/Tool/RequiredParameterTrait.php).

I figured out my issue working with this path instead: https://www.drupal.org/project/oauth2_client/issues/3064090

Comment #4

fathershawn

English

New York

commented 5 January 2021 at 23:26

Hi! @perelesnyk and I have stepped up as maintainers, officially for D9 compatible and forward. I've added this issue to our planning issue. The Oauth2 standard has Refresh tokens as optional in general:

Issuing a refresh token is optional at the discretion of the authorization server. If the authorization server issues a refresh token, it is included when issuing an access token

https://tools.ietf.org/html/rfc6749#section-1.5

So if a refresh token is returned with the original access token, we should use it on all grant types