0

I am working with different DXA 2.0 Webapplications together with SDL 8.5 . Out of 5 web application that I have, one of them all of a sudden for some unknown reason(I looked at logs but don't see any clear reason behind it) has its refresh token invalid. After that the web application is continuously trying to get the new token, however it is unable to do that and it is throwing the following error and log is full with this error,

{ "@timestamp": "2019-06-21T07:39:28.418+00:00", "severity": "INFO", "service": "***-***-WEB", "class": "c.sdl.web.client.impl.OAuthTokenProvider", "message": "Obtaining token using refresh token not successful: Unable to get response from OData service: {\"error\":\"Access Denied: Refresh token is not valid.\"}\n. Trying to obtain new one using client id/secret." }

Note: No changes have been made neither in CD servers not Discovery Service and other 4 Webapplications are working perfectly pointing to the same CD Servers. Isn't DXA 2.0 capable to renegotiate the connection to get new token so that we can avoid Webapplication restart?

One possible solution to this problem is to restart the WebApplication but I wanted to know if we can avoid such restart whenever this sort of error occurs.

Improve this question
4
  • Is that any hotfix applied to that box? All the microservices and web apps both LB group nodes timezone settings should be identical?
    – Velmurugan ♦
    Commented Jun 21, 2019 at 12:30
  • Hello @Velmurugan all the settings are identical in all our web apps and the CD microservices
    – Bimals Subedi
    Commented Jun 21, 2019 at 13:22
  • DXA does not have specific logic for OAuth handling; it relies on the CIL for this. So, your question is a general CIL question.
    – Rick Pannekoek
    Commented Jun 24, 2019 at 6:20
  • Thank you Rick, you are right that the OAuth handling is done in CIL . I found out that in my particular case the problem was in the expiry time of the token that is retrieved by calling /token.svc. We had really small expire time of the token and each time a new request goes to webapp after the expiry time, it was throwing that error and calculating the new token again.
    – Bimals Subedi
    Commented Jun 24, 2019 at 20:48

1 Answer 1

Reset to default
2

I figured out the answer to the problem I was having. Actually I had the problem in my /token.svc token expiration time. For example I had expiry time of 3 minutes and when a new call was invoked to my application on 6th minute the token was already expired and it was calculating the new token. I got a bit confused with the log because it was showing an error but in the later part of the same log it was also giving information it was calculating the token using the clientId/secret to which I didn't paid much attention. In my logs I always saw this log,

{
"@timestamp": "2019-06-21T07:39:28.418+00:00",
"severity": "INFO",
"service": "***-***-WEB",
"class": "c.sdl.web.client.impl.OAuthTokenProvider",
"message": "Obtaining token using refresh token not successful: Unable to get response from OData service: {\"error\":\"Access Denied: Refresh token is not valid.\"}\n. Trying to obtain new one using client id/secret."

}

Not paying attention to this text highlighted below in the log led me to investigate further on this issue and came-up with the conclusion that I explained above.

Trying to obtain new one using client id/secret.

Improve this answer
1
  • The info loglevel is confusing as well at first. It informs there's an issue, but accualy there's none. Thanks for your explaination; I was also thinking this was an issue but in the end it isn't.
    – Harmen
    Commented Sep 9, 2020 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.