0

I am working with different DXA 2.0 Webapplications together with SDL 8.5 . Out of 5 web application that I have, one of them all of a sudden for some unknown reason(I looked at logs but don't see any clear reason behind it) has its refresh token invalid. After that the web application is continuously trying to get the new token, however it is unable to do that and it is throwing the following error and log is full with this error,

{ "@timestamp": "2019-06-21T07:39:28.418+00:00", "severity": "INFO", "service": "***-***-WEB", "class": "c.sdl.web.client.impl.OAuthTokenProvider", "message": "Obtaining token using refresh token not successful: Unable to get response from OData service: {\"error\":\"Access Denied: Refresh token is not valid.\"}\n. Trying to obtain new one using client id/secret." }

Note: No changes have been made neither in CD servers not Discovery Service and other 4 Webapplications are working perfectly pointing to the same CD Servers. Isn't DXA 2.0 capable to renegotiate the connection to get new token so that we can avoid Webapplication restart?

One possible solution to this problem is to restart the WebApplication but I wanted to know if we can avoid such restart whenever this sort of error occurs.

  • Is that any hotfix applied to that box? All the microservices and web apps both LB group nodes timezone settings should be identical? – Velmurugan Jun 21 at 12:30
  • Hello @Velmurugan all the settings are identical in all our web apps and the CD microservices – Bimals Subedi Jun 21 at 13:22
  • DXA does not have specific logic for OAuth handling; it relies on the CIL for this. So, your question is a general CIL question. – Rick Pannekoek Jun 24 at 6:20
  • Thank you Rick, you are right that the OAuth handling is done in CIL . I found out that in my particular case the problem was in the expiry time of the token that is retrieved by calling /token.svc. We had really small expire time of the token and each time a new request goes to webapp after the expiry time, it was throwing that error and calculating the new token again. – Bimals Subedi Jun 24 at 20:48
1

I figured out the answer to the problem I was having. Actually I had the problem in my /token.svc token expiration time. For example I had expiry time of 3 minutes and when a new call was invoked to my application on 6th minute the token was already expired and it was calculating the new token. I got a bit confused with the log because it was showing an error but in the later part of the same log it was also giving information it was calculating the token using the clientId/secret to which I didn't paid much attention. In my logs I always saw this log,

{
"@timestamp": "2019-06-21T07:39:28.418+00:00",
"severity": "INFO",
"service": "***-***-WEB",
"class": "c.sdl.web.client.impl.OAuthTokenProvider",
"message": "Obtaining token using refresh token not successful: Unable to get response from OData service: {\"error\":\"Access Denied: Refresh token is not valid.\"}\n. Trying to obtain new one using client id/secret."

}

Not paying attention to this text highlighted below in the log led me to investigate further on this issue and came-up with the conclusion that I explained above.

Trying to obtain new one using client id/secret.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.