Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Is there any way to force refresh the token? #2483

Closed
ffeliciodeveloper opened this issue Jun 15, 2023 · 22 comments
Closed

Is there any way to force refresh the token? #2483

ffeliciodeveloper opened this issue Jun 15, 2023 · 22 comments
Assignees
Labels
auth Related to the Auth category/plugins bug Something isn't working pending-community-response Issue is pending response from the issue requestor

Comments

@ffeliciodeveloper
Copy link

ffeliciodeveloper commented Jun 15, 2023

Good morning/Good afternoon/Good evening everyone

First of all, thank you very much for your help in advance.

Here's the thing, I'm using the library and I'm facing some problems using it.

The application that I'm applying Amplify, uses the feature through the signInWithWebUI method (the lib calls a webView automatically) to perform the login through a custom interface created by the Web Frontend team.

After successfully logging in, I need to verify that the Amplify token has not expired in certain data transmission processes.

When I use the fetchUserAttributes method, it is falling into the expired Token flow and through Log.i the information below is shown:

NotAuthorizedException{message=Failed since user is not authorized., cause=NotAuthorizedException(message=Access Token has expired), recoverySuggestion=Check whether the given values ​​are correct and the user is authorized to perform the operation.}

When this flow occurs, I open an alertDialog informing that the session has expired and that there is a need to carry out a login process.
When the user confirms the execution, I call the signInWithWebUI method again to open the webView and perform the login processes again.

After this call, it is always falling into the error block stating that the session is active and to proceed, it is necessary to logoff and login again.

I would like to know if there would be a simple way to force the renewal of the token or would there be a way to change some implementation?

Below I leave the snippet of code for you to understand better:

class BaseActivity : AppCompatActivity() {
    ...

    private fun checkExpiredToken(callback : () -> Unit) {
        Amplify.Auth.fetchUserAttributes(
            {
                // method called if the token is active
                callback()
            }
        ) {
            // If the token is expired, it will call the dialog for the user to follow the flows
            Log.i("AmplifyQuickstart-realizeLoginAD-callAmplify", it.toString())
            runOnUiThread {
                if (!this@LoggedBaseActivity.isFinishing) {
                    openDialog(
                        titleId = R.string.app_title,
                        message = getString(R.string.message_for_ad_authentication),
                        includeNeutralButton = true,
                        cancelFun = null,
                        confirmFun = ::callAmplify
                    )
                }
            }
        }
    }

    private fun callAmplify() {
        // options found in searches here in issues
        val options = AuthFetchSessionOptions.builder().forceRefresh(true).build()

        Amplify.Auth.signInWithWebUI(
            this@LoggedBaseActivity,
            { authSigninInResult ->
                if(authSigninInResult.isSignedIn) {
                    Amplify.Auth.fetchAuthSession(
                        options,
                        {
                            Log.i("AmplifyQuickstart-realizeLoginAD", authSigninInResult.toString())
                            fetchUserAttributes(authSession as AWSCognitoAuthSession)
                        },
                        { authException ->
                            Log.e("AmplifyQuickstart-realizeLoginAD", "Failed to fetch auth session", authException)
                        }
                    )
                }
            },
            {
                // it is always falling in this case and reporting the error:
                // SignedInException{message=A user is already signed in., cause=null, recoverySuggestion=Log out user before signing in again}
                Log.e("AuthQuickStart", "Signin failed", it)
            }
        )
    }

    private fun fetchUserAttributes(awsCognitoAuthSession: AWSCognitoAuthSession) {
        val authSessionResultAWSCognitoUserPoolTokens : AuthSessionResult<AWSCognitoUserPoolTokens> = awsCognitoAuthSession.userPoolTokensResult
        val authSessionResult : AuthSessionResult<String> = awsCognitoAuthSession.userSubResult
        val awsCognitoUserPoolTokens : AWSCognitoUserPoolTokens = authSessionResultAWSCognitoUserPoolTokens.value as AWSCognitoUserPoolTokens
        Log.i("AuthQuickStart Amplify", authSessionResultAWSCognitoUserPoolTokens.toString())
        Log.i("AuthQuickStart Amplify", authSessionResult.toString())
        Log.i("AuthQuickStart Amplify", awsCognitoUserPoolTokens.toString())

        Amplify.Auth.fetchUserAttributes(
            { listAuthUserAttribute ->
                Log.e("AmplifyQuickstart-fetchUserAttributes", "fetch user attributes", listAuthUserAttribute.toString())
            },
            {
                Log.e("AmplifyQuickstart-fetchUserAttributes", "Failed to fetch user attributes", it)
            }
        )
    }
}

If the Amplify.Auth.fetchAuthSession method is used, the user data linked to Cognito is returned correctly, so I would like to know if there is a way to renew the token, I saw that in Javascript there is a way to carry out this process, but on Android I ended up not finding anything yet.

In advance, I'm sorry for the problem (I'm already desperate to solve it kkkkkkk) and thank you very much for all your help.

@div5yesh div5yesh added the auth Related to the Auth category/plugins label Jun 15, 2023
@div5yesh div5yesh self-assigned this Jun 15, 2023
@gpanshu
Copy link
Contributor

gpanshu commented Jun 22, 2023

Hi @ffeliciodeveloper you can force refresh the token. Sample code can be found here

@gpanshu gpanshu assigned gpanshu and unassigned div5yesh Jun 22, 2023
@gpanshu gpanshu added pending-community-response Issue is pending response from the issue requestor closing soon This issue will be closed in 7 days unless further comments are made. labels Jun 22, 2023
@ffeliciodeveloper
Copy link
Author

Many thanks for the reply @gpanshu!

I made use of the option statement mentioned in my login process.

Since I'm not familiar with the library, I thought there was some method that could be called when the access token expires (usually set to renew every 1 hour).
I saw some Javascript implementations for this and I believed that specific methods existed in Android as well.

Since the login flow depends on a webpage, every time Amplify reports that the user data is invalid (using the fetchUserAttributes method), I force logout through Amplify and inform the user that the login action must be done again.
Even calling the signInWithWebUI method in the exceptions of the fetchUserAttributes method when the access token expires, an error occurs stating that the session when calling the signInWithWebUI method is still active and in the error block it informs that it is necessary to logout and login again, due to the method signInWithWebUI cannot be called multiple times in code.

I ended up finding this solution (I don't know if it would be the most correct), but it ended up working for me.
As access depends on a web page (webView) hosted on another server, I had this implementation idea.
I sent it to tests to see if it meets the flow they currently need.

In the Amplify for Android doc I didn't find anything specific or an implementation that I could include to update accessToken and idToken without having to do the steps I described.

Again, thank you so much for your support.

@gpanshu
Copy link
Contributor

gpanshu commented Jun 22, 2023

What was the solution that you found @ffeliciodeveloper ?

Also once your session is expired you have to manually log out and log back in again as the app will still be in the signed in state with invalid credentials. You can however make sure your refresh token has a long expiry and that you refresh your access token well before its expiry which will ensure your session remains active.

@ffeliciodeveloper
Copy link
Author

Good morning @gpanshu.

Thank you very much for answering me.

What was the solution that you found @ffeliciodeveloper?

About the question above, I always force the signout (only in Amplify), and after the successful logout, I call the method that does the signin through signInWithWebUi.

How is it working here in the app?

Our app is offline first.
When the device connects to the internet, the broadcast triggers various events to send the stored data to the server.
This same process occurs when the app is in the background and returns to the foreground.
So, every time these processes occur, I use the fetchUserAttributes method to know if the access is ok or not.
As the fetchUserAttributes method returns the exceptions NotAuthorizedException, SessionExpiredException and SignedOutException, inside each one I show a specific message and then I call Amplify's signInWithWebUI method.

You must be wondering "why all this?"

The app login process depends on a platform hosted on the customer's server that will use the app.
They use a form of centralized access internally and want to include that same flow in the app.
Their login screens look a lot like Microsoft's login interfaces (Outlook and Teams for example).

That's why I ended up doing this process of always signingOut only to Amplify and then triggering the signInWithWebUI method to force the user to perform the login process on the platform they use internally.

Also once your session is expired you have to manually log out and log back in again as the app
will still be in the signed in state with invalid credentials.
You can however make sure your refresh token has a long expiry and that you refresh your access token
well before its expiry which will ensure your session remains active.

About what I reported above, would you have an example so I can understand better?

In fact, I wanted to know if there was a more correct way to do it without having to carry out this whole flow that I mentioned earlier, that is, always calling signOut and calling signInWithWebUI again.

I tried calling the signInWithWebUI method directly when I ran into some exception when calling the fetchUserAttributes method, but it always throws the exception of the signInWithWebUI method stating that the session is still active, and that's why I included this solution of always logging out of Amplify and then doing the login again with signInWithWebUI method.

@gpanshu
Copy link
Contributor

gpanshu commented Jun 23, 2023

So just so you know the refreshing of the credentials is handled by fetchAuthSession which is what you need instead of fetchUserAttributes. As fetchAuthSession will refresh your credentials or return a notAuthorized (if guest access is not allowed) and then you can chose to sign out the user instead of always signing out the user.
Try that and see if that alleviates some of the pain points you are experiencing. We can also choose to have an internal timer to check when the access token expires and refresh(force) the refreshing of accessToken via fetchAuthSession. That way you will always be in a good state and if you received a session expiry or a not authorized exception you can proceed with the sign out flow.

Hope this helps.

@ffeliciodeveloper
Copy link
Author

Good afternoon @gpanshu.

So, based on your answer, I could use the fetchAuthSession method to make the entire accessToken and idToken expiration flow, would that be what I understood?

Would it be a problem to keep calling this method in the moments I mentioned? (return from the internet or the app stays in the foreground).

It would help me a lot.
As the accessToken and idToken are set to expire every 1 hour, I would need to renew the value inside the device and send the new accessToken and idToken to bind on the server.

From the tests I did here earlier with the method you indicated (using the AuthFetchSessionOptions.builder().forceRefresh(true).build() option together), even if the accessToken and idToken are expired, it always falls in the block referring to the success in the redemption process, so I ended up using the fetchUserAttributes method.
I just didn't catch the situation when the refreshToken expires when using the fetchAuthSession method.
As it has a long expiration period, I ended up not falling into the exception cases of the fetchAuthSession method.

I think my biggest problem is knowing when accessToken and idToken expire within the app.
As I can get this information only in the fetchUserAttributes method, I ended up getting lost in the implementation of this accessToken and idToken renewal feature.

To make it a little more difficult, the app works in different time zones, so you can't guarantee control of the expiration time as mentioned.

Currently the app has 2 login flows, the first using an SSO feature and the other using Amplify.
This rule is made according to the email domain that the user enters in the specific field, if the user enters an email domain that is not linked to the process using Amplify, it will call an api and that same api returns the token expiration time (in milliseconds), but in the case of the flow using Amplify, this information is not returned.

@gpanshu
Copy link
Contributor

gpanshu commented Jun 23, 2023

No what I am saying is that call fetchAuthSession before it expires to get new tokens. If your tokens are expired you will either get the Session Expired hub event OR a notAuthorizedException both of which you can handle to sign out and and sign in the user. You can capture the token expiration time by converting the JWT String to JWT and capturing the expiration time from there if you would like to manage its lifecycle but a refresh on each time the app is started and/or every x minutes should be sufficient. And if it returns expired or not authorized then you force the sign in. If you would like to get on a call and discuss you can book sometime on discord or https://prelude.amazon.com/s/fmeOGZKpI/TRNwwi

@ffeliciodeveloper
Copy link
Author

Good afternoon @gpanshu!
Are you well?

On your suggestion mentioned above, I performed the operation you indicated.
Before performing accessToken and idToken expiration process, I called the operation as below:

val option : AuthFetchSessionOptions = AuthFetchSessionOptions.builder().forceRefresh(true).build()

Amplify.Auth.fetchAuthSession(
    option,
    {
        val awsCognitoAuthSession = it as AWSCognitoAuthSession
        Log.i("fetchAuthSession", awsCognitoAuthSession.toString())

        val authSessionResultAWSCognitoUserPoolTokens : AuthSessionResult<AWSCognitoUserPoolTokens> = awsCognitoAuthSession.userPoolTokensResult
        val awsCognitoUserPoolTokens : AWSCognitoUserPoolTokens = authSessionResultAWSCognitoUserPoolTokens.value as AWSCognitoUserPoolTokens

        val idToken = awsCognitoUserPoolTokens.idToken!!
        val accessToken = awsCognitoUserPoolTokens.accessToken!!

        Log.i("fetchAuthSession_ID_TOKEN", idToken)
        Log.i("fetchAuthSession_ACCESS_TOKEN", accessToken)

        var jwt = JWT(idToken)
        Log.i("fetchAuthSession_JWT_ID_TOKEN_ISSUE_AT", jwt.issuedAt.toString())
        Log.i("fetchAuthSession_JWT_ID_TOKEN_ISSUE_TIME", jwt.issuedAt?.time.toString())
        Log.i("fetchAuthSession_JWT_ID_TOKEN_EXPIRED_AT", jwt.expiresAt.toString())
        Log.i("fetchAuthSession_JWT_ID_TOKEN_EXPIRED_TIME", jwt.expiresAt?.time.toString())

        jwt = JWT(accessToken)
        Log.i("fetchAuthSession_JWT_ID_TOKEN_ISSUE_AT", jwt.issuedAt.toString())
        Log.i("fetchAuthSession_JWT_ID_TOKEN_ISSUE_TIME", jwt.issuedAt?.time.toString())
        Log.i("fetchAuthSession_JWT_ID_TOKEN_EXPIRED_AT", jwt.expiresAt.toString())
        Log.i("fetchAuthSession_JWT_ID_TOKEN_EXPIRED_TIME", jwt.expiresAt?.time.toString())

        var expiresIn : Long = 0
        if(jwt.expiresAt != null && jwt.issuedAt != null) {
            expiresIn = jwt.expiresAt?.time!!.minus(jwt.issuedAt?.time!!)
        }

        Log.i("fetchAuthSession_JWT_ID_TOKEN_EXPIRED_TIME", expiresIn.toString())

        jwt = JWT(accessToken)
        Log.i("fetchAuthSession_JWT_ACCESS_TOKEN_ISSUE_AT", jwt.issuedAt.toString())
        Log.i("fetchAuthSession_JWT_ACCESS_TOKEN_EXPIRED_AT", jwt.expiresAt.toString())
    },
    { authException ->
        Log.e("fetchAuthSession", "Failed to fetch auth session", authException)
    }
)

Even doing as described above, my token data (accessToken/idToken), were not updated, the old values ​​are still maintained.

I was able to access the Amplify discord (uri https://discord.com/channels/705853757799399426/1095000026247348265/1095732566092415038) and found a problem like mine and the same operation I currently perform was suggested, that is, force the signOut and then perform the signIn again.

I also tested by calling the fetchAuthSessions method several times, but even so, the accessToken and idToken information is not renewed.

@gpanshu
Copy link
Contributor

gpanshu commented Jun 26, 2023

HI @ffeliciodeveloper I am going to test this and get back to you as forcing a refresh if your tokens are valid should return you new tokens.

@eeatonaws eeatonaws added bug Something isn't working and removed pending-community-response Issue is pending response from the issue requestor closing soon This issue will be closed in 7 days unless further comments are made. labels Jun 27, 2023
@ffeliciodeveloper
Copy link
Author

Hello @gpanshu!

Thanks for your help!

@gpanshu
Copy link
Contributor

gpanshu commented Jun 29, 2023

Hi @ffeliciodeveloper as per your suggestion I setup my access token to expire every 60 minutes and refresh token to expire every 90 days.

Then I changed my clock forward to see if I can do fetchUserAttributes or fetchAuthSession (both worked). After that I put my app in background for the day and opened it up again and did a fetchAuthSession(forced) and that forced the access tokens to refresh. I noticed that the access tokens if expired refreshed as long as the refresh token was valid with new expiry times.
I also tested fetchAuthSession in succession with forceRefresh as false and true respectively and the second call to fetchAuthSession with forceRefresh as true gave me entirely new tokens with a different expiry time.

Here are some troubleshooting steps that could help up with your issue:

  1. ensure you have openid in your scope if you are using hostedUI source
  2. Add Amplify.addPlugin(AndroidLoggingPlugin(LogLevel.DEBUG)) as the first plugin in your list of plugins in your application class and paste the sequence of events from the logcat to help debug this further.

@ffeliciodeveloper
Copy link
Author

Good afternoon @gpanshu

Please forgive me for the delay in responding.

So this is the problem I'm really facing.
As access to the app is done through AD, I don't have much control over the expiration time of the tokens returned by AD, so I'm using the way I described (I'll leave the example below).
As we don't have the control to increase the time of the tokens, I'm using the fetchUserAttributes to find out if the accessToken/idToken expired.
Below is the treatment I did.

package test

import android.util.Log
import androidx.lifecycle.lifecycleScope
import aws.sdk.kotlin.services.cognitoidentityprovider.model.TimeUnitsType
import com.amplifyframework.auth.AWSCognitoUserPoolTokens
import com.amplifyframework.auth.AuthChannelEventName
import com.amplifyframework.auth.AuthUserAttribute
import com.amplifyframework.auth.cognito.AWSCognitoAuthSession
import com.amplifyframework.auth.cognito.result.AWSCognitoAuthSignOutResult
import com.amplifyframework.auth.exceptions.NotAuthorizedException
import com.amplifyframework.auth.exceptions.SessionExpiredException
import com.amplifyframework.auth.exceptions.SignedOutException
import com.amplifyframework.auth.options.AuthFetchSessionOptions
import com.amplifyframework.auth.options.AuthSignOutOptions
import com.amplifyframework.auth.result.AuthSessionResult
import com.amplifyframework.core.Amplify
import com.amplifyframework.core.InitializationStatus
import com.amplifyframework.hub.HubChannel
import com.auth0.android.jwt.JWT
import kotlinx.coroutines.launch
import kotlinx.serialization.decodeFromString
import kotlinx.serialization.json.Json
import org.koin.androidx.viewmodel.ext.android.viewModel
import tech.ambar.eva.android_services.services.interfaces.ServiceCallbacks
import tech.ambar.eva.domain.login.model.UserAttributesAD


open class LoggedBaseActivity: BaseActivity(), DataUpdateListener, ServiceCallbacks {
    companion object {
        val TAG : String = "LoggedActivity"
    }

    // method called when the app returns to the foreground and when the internet returns.
    override fun executeProcessLinkedAmplify(
        callback : () -> Unit,
        executedByRestartFront : Boolean
    ) {

        /*
        Even calling the fetchAuthSession method every time the app returns to the foreground or the internet also returns,
        the updated token data (accessToken/idToken) is not updated.
        Even if the token values ​​expire, it always returns me the previous value, it is never renewed,
        that's why I use the fetchUserAttributes method. Only with it can I know if the token has expired.
        */
        fetchAuthSession()

        Amplify.Auth.fetchUserAttributes(
            {
                // calls callback function if accessToken/idToken is not expired
                callback()
            }
        ) {
            when(it) {
                is NotAuthorizedException -> {
                    // Force signOut on Amplify and inform user about token expiration.
                    // This is where I have the expired accessToken response
                    forceLogoutAfterNotAuthorizedException(callback)
                }
                is SessionExpiredException -> {
                    showDialogForSessionExpired(callback, message = "Session expired.\nYour account needs to be re-authenticated by AD")
                }
                is SignedOutException -> {
                    // 
                    showDialogForSessionExpired(
                        callback = { signInWithWebUI(callback) },
                        message = "Session ended. Your account requires AD authentication"
                    )
                }
                else -> {
                    Log.d("TAG", "$it")
                }
            }
        }
    }

    private fun fetchAuthSession() {
        val option : AuthFetchSessionOptions = AuthFetchSessionOptions.builder().forceRefresh(true).build()

        Amplify.Auth.fetchAuthSession(
            option,
            {
                val awsCognitoAuthSession = it as AWSCognitoAuthSession
                Log.i(TAG, awsCognitoAuthSession.toString())

                val authSessionResultAWSCognitoUserPoolTokens : AuthSessionResult<AWSCognitoUserPoolTokens> = awsCognitoAuthSession.userPoolTokensResult
                val awsCognitoUserPoolTokens : AWSCognitoUserPoolTokens = authSessionResultAWSCognitoUserPoolTokens.value as AWSCognitoUserPoolTokens

                val idToken = awsCognitoUserPoolTokens.idToken!!
                val accessToken = awsCognitoUserPoolTokens.accessToken!!

                Log.i(TAG, idToken)
                Log.i(TAG, accessToken)

                var jwt = JWT(idToken)
                Log.i(TAG, jwt.issuedAt.toString())
                Log.i(TAG, jwt.issuedAt?.time.toString())
                Log.i(TAG, jwt.expiresAt.toString())
                Log.i(TAG, jwt.expiresAt?.time.toString())

                jwt = JWT(accessToken)
                Log.i(TAG, jwt.issuedAt.toString())
                Log.i(TAG, jwt.issuedAt?.time.toString())
                Log.i(TAG, jwt.expiresAt.toString())
                Log.i(TAG, jwt.expiresAt?.time.toString())

                // handling to get token expiry time
                var expiredTime : Long = 0
                if(jwt.expiresAt != null && jwt.issuedAt != null) {
                    expiredTime = jwt.expiresAt?.time!!.minus(jwt.issuedAt?.time!!)
                }

                Log.i(TAG, expiredTime.toString())

                jwt = JWT(accessToken)
                Log.i(TAG, jwt.issuedAt.toString())
                Log.i(TAG, jwt.expiresAt.toString())
            },
            { authException ->
                Log.e(TAG, "Failed to fetch auth session", authException)
            }
        )
    }

    private fun showDialogForSessionExpired(
        callback : () -> Unit,
        message : String
    ) {
        runOnUiThread {
            if (!this@LoggedBaseActivity.isFinishing) {
                ranTheCallOnRestartFront = true
                openDialog(
                    titleId = R.string.app_title,
                    message = message,
                    includeNeutralButton = true,
                    cancelFun = {},
                    confirmFun = {
                        signInWithWebUI(callback)
                    }
                )
            }
        }
    }

    // method used to call the customer's AD
    private fun signInWithWebUI(callback : () -> Unit) {
        Amplify.Auth.signInWithWebUI(
            this@LoggedBaseActivity,
            { authSigningInResult ->
                if(authSigningInResult.isSignedIn) {
                    Amplify.Auth.fetchAuthSession(
                        AuthFetchSessionOptions.builder().forceRefresh(true).build(),
                        {
                            fetchUserAttributes(it as AWSCognitoAuthSession, callback)
                        },
                        {}
                    )
                }
            },
            {
                logoutAmplify(callback)
            }
        )
    }

    private fun logoutAmplify(callback : () -> Unit) {
        Amplify.Auth.signOut(options) { signOutResult ->
            when(signOutResult) {
                is AWSCognitoAuthSignOutResult.CompleteSignOut -> {
                    signInWithWebUI(callback)
                }
                is AWSCognitoAuthSignOutResult.FailedSignOut -> {}
            }
        }
    }

    private fun forceLogoutAfterNotAuthorizedException(callback : () -> Unit) {
        Amplify.Auth.signOut(options) { signOutResult ->
            when(signOutResult) {
                is AWSCognitoAuthSignOutResult.PartialSignOut -> {
                    showDialogForSessionExpired(callback, message = "Your account needs AD authentication")
                }
                is AWSCognitoAuthSignOutResult.CompleteSignOut -> {}
                is AWSCognitoAuthSignOutResult.FailedSignOut -> {}
            }
        }
    }

    private fun fetchUserAttributes(awsCognitoAuthSession: AWSCognitoAuthSession, callback : () -> Unit) {
        val authSessionResultAWSCognitoUserPoolTokens : AuthSessionResult<AWSCognitoUserPoolTokens> = awsCognitoAuthSession.userPoolTokensResult
        val authSessionResult : AuthSessionResult<String> = awsCognitoAuthSession.userSubResult

        if(authSessionResultAWSCognitoUserPoolTokens.value == null) {
            return
        }

        val awsCognitoUserPoolTokens : AWSCognitoUserPoolTokens = authSessionResultAWSCognitoUserPoolTokens.value as AWSCognitoUserPoolTokens

        Amplify.Auth.fetchUserAttributes(
            { listAuthUserAttribute ->
                val authUserAttributeList : List<AuthUserAttribute> = listAuthUserAttribute
                val authUserData = authUserAttributeList[1].value as String
                val userAttributesADMapper : Array<UserAttributesAD> = Json.decodeFromString(string = authUserData)
                val userAttributesAD : UserAttributesAD = userAttributesADMapper.first()
                var authUserAttributeEmail : String? = null

                // handling to get token expiry time
                var expiresIn : Long = 0
                if(awsCognitoUserPoolTokens.idToken != null) {
                    val jwt = JWT(awsCognitoUserPoolTokens.idToken!!)
                    if(jwt.expiresAt != null && jwt.issuedAt != null) {
                        expiresIn = jwt.expiresAt?.time!!.minus(jwt.issuedAt?.time!!)
                    }
                }

                viewModel.userAttributesAD = userAttributesAD.copy(
                    sessionResult = authSessionResult.value,
                    idToken = awsCognitoUserPoolTokens.idToken,
                    accessToken = awsCognitoUserPoolTokens.accessToken,
                    refreshToken = awsCognitoUserPoolTokens.refreshToken,
                    email = authUserAttributeEmail,
                    expiresIn = expiresIn
                )

                viewModel.loginPerformedByAD()
            },
            {
            }
        )
    }
}

Do you have any gist or code example that I could use to see where I'm going wrong in the accessToken/idToken renewal flow, please?

Thank you in advance for your help and I'm sorry for so many messages about this, but I haven't found anything referring to what I need in the documentation or in searches on the internet.

@gpanshu
Copy link
Contributor

gpanshu commented Jun 30, 2023

@ffeliciodeveloper thank you so much for your patience while we deal with this to help unblock you.

  1. Can you add the debug logs here as I had asked for in my previous message.
  2. Schedule a call with me through prelude and we can debug together.

@gpanshu gpanshu added the p2 label Jul 5, 2023
@ffeliciodeveloper
Copy link
Author

Good afternoon @gpanshu!

Again, sorry for the delay in responding.

Thanks for the support.
I'm checking with my manager so I can come in and talk about the problem.

I apologize for that, it's just that my understanding of English is still very weak.
I will schedule a conversation with my manager and schedule this meeting.

Thanks for the help you are giving.

@gpanshu
Copy link
Contributor

gpanshu commented Jul 6, 2023

You do not need to do come in for the meeting and we can have a virtual screenshare meeting. I would like to unblock you asap as I see you have been struggling for a while. Just use the link I provided you to book a meeting in your calendar.

@ffeliciodeveloper
Copy link
Author

Good afternoon @gpanshu!

I performed schedule creation to check token refresh feature.

I created it with my own account, but someone else will accompany me on this solution that I'm having problems solving.
As I am not yet proficient in speaking English, I will ask someone else to help me to pass on the necessary information.

Again, thanks a lot for your help.

@ffeliciodeveloper
Copy link
Author

Hello @gpanshu!

Good morning!

What will our conversation be like today?

Should I wait for your call?

@gpanshu
Copy link
Contributor

gpanshu commented Jul 20, 2023

As per our conversation please report back once you have fixed your configuration file as that might be the root of the problem.

@gpanshu gpanshu added pending-community-response Issue is pending response from the issue requestor and removed p2 labels Jul 20, 2023
@gpanshu gpanshu added the p3 label Jul 20, 2023
@mattcreaser mattcreaser removed the p3 label Jul 25, 2023
@gpanshu
Copy link
Contributor

gpanshu commented Aug 23, 2023

As discussed over the call, this problem is now fixed. The problem was due to configuration being incorrect and also sign out not invalidating 3P session.

@gpanshu gpanshu closed this as completed Aug 23, 2023
@github-actions
Copy link
Contributor

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

@sekitaka
Copy link

@gpanshu
Hi , I have the same issue. How do I fix my configuration?

@gpanshu
Copy link
Contributor

gpanshu commented Oct 30, 2023

Hi @sekitaka what problem are you facing? Can you elaborate? It might be better to create a new issue referencing this issue and attaching as much information as possible.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
auth Related to the Auth category/plugins bug Something isn't working pending-community-response Issue is pending response from the issue requestor
Projects
None yet
Development

No branches or pull requests

6 participants