In case of OAuth2 and OpenID Connect user authorized AppA to access AppB service. Now AppB needs to access AppC and it uses the bearer token received from AppA (suppose the scope of that token included both B & C):

AppA -Bearer-> AppB -Bearer-> AppC

But what if AppB needed access to AppC for long time (some polling happens for couple of hours). The Bearer token is revoked by that time and AppB doesn't have refresh token (AppA has). What are the options here?


Well, the simplest approach is to just push the refresh token down to App B as well and let it handle refreshing itself. This could lead to some unintended behaviors on App A though if the refresh token is refreshed on refresh as well (say that 5 times).

What you might consider doing is adjusting the authorization server to exchange an access token for an access/refresh token pair, so App A sends it's token to App B, and App B takes that token and exchanges it with the authorization server for it's own tokens. Then it manages the token on its own. That assumes you can modify the authz server though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.