Access token cannot be refreshed. Please re-authenticate

Question

I get this error when refreshing the access token: Access token cannot be refreshed. Please re-authenticate

This error had previously reported on April 2017. The OneLogin docs state that the refresh token is good for 45 days or so. My refresh token was about 20 hours old. Is the doc right or does the refresh token have a shorter life span? I can do the get Access Token and Revoke token fine.

public RootObject RefreshToken(HttpRequesterDM rDM) { RestSharp.Deserializers.JsonDeserializer deserial = new RestSharp.Deserializers.JsonDeserializer(); var client = new RestClient("https://api.us.onelogin.com/auth/oauth2/token"); var request = new RestRequest(Method.POST); string clientAuth = $"client_id:{rDM.ClientID}, client_secret:{rDM.ClientSecret}"; string accessToken = DSBase.AccessToken; string refreshToken = DSBase.refreshToken; request.AddHeader("cache-control", "no-cache"); request.AddHeader("content-type", "application/json"); request.RequestFormat = DataFormat.Json; request.AddParameter("application/json", "{\n\"grant_type\":\"refresh_token\"\n}", ParameterType.RequestBody); request.AddHeader("authorization", clientAuth);

        request.AddParameter("application/json", "{\n\"access_token\":\" + accessToken + \"\n}", ParameterType.RequestBody);
        request.AddParameter("application/json", "{\n\"refresh_token\":\" + refreshToken + \"\n}", ParameterType.RequestBody);
        IRestResponse response = client.Execute(request);

        RootObject returnData = deserial.Deserialize<RootObject>(response);
        if (returnData.status.message == "Access token cannot be refreshed. Please re-authenticate")
        {
            RootObject rObject = GetToken(rDM);
            return rObject;
        }
        if (returnData.data[0].access_token != null)
        {
            access = returnData.data[0].access_token; //This correctly gets the Access Token. You should return this to a class variable so that all the  other functions can access it easily and you're not constantly passing along the variable through them.

        }
        return returnData;

John Hanley John Hanley · Accepted Answer · 2019-10-14T17:15:09

Refresh Tokens can expire, be revoked, be refused. Since OneLogin is an SSO, the user might have logged out of their identity provider which invalided the refresh token. You will need to design your software to handle errors and edge cases. The error message is clear, your user must authenticate again. There is nothing to do/change/correct in your code, except in the case you are sending an invalid/wrong refresh token.

Access token cannot be refreshed. Please re-authenticate

1 Answers