Some OAuth2 providers don't issue a refresh token with the original token (most significantly, Google OAuth2 API doesn't).
That means when a token is expired and this module tries to refresh the token using the refresh_token, the module crashes because refresh_token is blank.
I've got a fix for this in my deployment, I will format a patch and submit it.
| Comment | File | Size | Author |
|---|---|---|---|
| #7 | enforce_return_get_access_token-3040828-7.patch | 4.44 KB | m4olivei |
| #2 | 0001-Fall-back-to-getting-a-new-access-token-if-the-store.patch | 1.42 KB | Ashley.Sommer |
Comments
Comment #2
Ashley.Sommer commentedComment #3
Ashley.Sommer commentedComment #4
m4oliveiI think the issue here is that
\Drupal\oauth2_client\Service\Grant\Oauth2ClientGrantServiceInterface::getAccessTokendoesn't have a return value and it should.I'm using the
client_credentialsgrant with my plugin, and it has a similar issue when I do the following, asking for the access token for the first time:The
\Drupal\oauth2_client\Service\Oauth2ClientService::getAccessTokenmethod is returningnull, which I don't think is the intent.I'll try an alternate patch to illustrate.
Comment #5
m4oliveiComment #6
m4oliveiComment #7
m4oliveiHow about this?
Comment #8
m4oliveiComment #10
Ashley.Sommer commented@m4olivei
Your patch looks good, but I don't see how it is related to the original issue.
This issue was created to deal with the problem that some oauth providers do not issue a refresh token, so when the stored token expires, the client_credentials grant provider tries to use the refresh_token to get a new access token, even if the refresh_token is empty or missing, this causes php errors to be generated and oauth2_client module no longer works.
Comment #11
Ashley.Sommer commented@m4olivei
I see, looks like you intended to comment against this issue: https://www.drupal.org/project/oauth2_client/issues/3041788
Comment #12
Ashley.Sommer commentedThis is a blocking bug in the application I am working on.
If there are no more issues to be raised, this patch will be merged in 48 hours.
Comment #13
Ashley.Sommer commentedComment #14
m4oliveiAhh sorry about that. Not sure what I did. Perhaps your right and my patch was better suited to the other issue. In any case, I decided to go another route with what I was trying to do and use thephpleague/oauth2-client directly.
Comment #15
pbosmans commentedPatch #2 almost worked for me.
The first time after the expiration of the token, i got an empty access token.
This is because the getaccesstoken method of the grantservice doesn't return a token. It only sets the token.
So i added one line at the end of your patch to get the real access-token.
Comment #16
Ashley.Sommer commented@pbobsmans
It looks like you, too, are trying for a solution to the other issue: https://www.drupal.org/project/oauth2_client/issues/3041788
This issue (3040828) is about fixing the bug relating to empty `refresh_token`, not empty `access_token`.
Comment #17
pbosmans commentedOops, i was confused about the used method (getClientCredentialsAccessToken) and the explanation of this module at https://www.drupal.org/docs/8/modules/oauth2-client/oauth2-client-8x-2x.
Especially the last sentence : 'If a token has not been generated, the authentication process will be initiated.'
That doesn't worked when the token was expired. I will reference this on the issue you mentioned and switch to it.
Comment #19
Ashley.Sommer commentedMerged patch #1 0001-Fall-back-to-getting-a-new-access-token-if-the-store.patch
Comment #20
Ashley.Sommer commented