Cannot renew access token with refresh token

[9d4]

Always got same error when trying to refresh the token, here's the request log i've made

POST /application/o/token/ HTTP/1.1
User-Agent: PostmanRuntime/7.31.3
Accept: */*
Postman-Token: 5e7966d4-7ef9-4a01-aed6-99d5e4c7fd75
Host: xxxxxx
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 310
Cookie: authentik_csrf=J0KBNeRsf24eJ6JuAPmdbG488tZfYHj2; authentik_session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOiJ2MjM3ZWdnMGw1eGJtN3Uzd2RmdjV1eXNob210eHZleSIsImlzcyI6ImF1dGhlbnRpayIsInN1YiI6ImFub255bW91cyIsImF1dGhlbnRpY2F0ZWQiOmZhbHNlLCJhY3IiOiJnb2F1dGhlbnRpay5pby9jb3JlL2RlZmF1bHQifQ.6BuuBo74gDDu9EqK1_Uw9TM1mm6K6k6XYIVYHGiREBI
 
refresh_token=%60%25%23Q%3E'LgZbiKS.%5D%3A0%237%7Cj%5C%5C961mS7g068rH%2F(E(bDr%26d'jcv%5C%22g'e%3DWJl%3CyXUx%24i%3DTq%5Et*%5Bi%3CdKhniE%7DNxQWlP8%5DKIM)s'%5E)2K%7Cj6%3D%2C%3FEN%26GDrzZ4%26%60_%5C%5CFioxZAs%5C%226U~n4&client_id=a8bf2d05b35099149f01b4a91d549c5a93437450&grant_type=refresh_token
 
HTTP/1.1 400 Bad Request
Server: nginx/1.22.1
Date: Fri, 24 Mar 2023 14:32:32 GMT
Content-Type: application/json
Content-Length: 176
Connection: keep-alive
Cache-Control: no-store
Content-Encoding: gzip
Pragma: no-cache
Referrer-Policy: same-origin
Vary: Accept-Encoding
Vary: Cookie
X-Authentik-Id: e20ede8e60d547aab178a37acfe25f98
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Powered-By: authentik
 
{"error": "invalid_grant", "error_description": "The provided authorization grant or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client"}

The request was done using postman. After going around, I had an idea to check the server's docker log, and I got something said like "Refresh token not found". I just keep trying, and only one refresh token that worked, but I've lost it. What's the problem then? Thank you for helping me.

[BeryJu]

Since it's not included in your request above, are you sending any kind of authentication with this request? For a token request, you can either send the client_id and client_secret post parameters or using http basic authentication with the client_id as username and the client_secret as password

[9d4]

I tried it before, but just the same.

POST /application/o/token/ HTTP/1.1
Authorization: Basic YThiZjJkMDViMzUwOTkxNDlmMDFiNGE5MWQ1NDljNWE5MzQzNzQ1MDpiYTAzNzllMmZlZjYyZmZlNTFiOTJmZGNkYTkyMzExZWQ3MmZlM2NmMmFhYzQwZDE2MDAyOTdmMmQwMjdmOWMyMGU5YTQ1MDg4MDQ1MTFlOTQ0ZWY5NDBiYmRmYThhZDk1NDJmZTQ3YzI0ZGEwNThkZDQ4OGYwYTJhYmNhMGZjMg==
User-Agent: PostmanRuntime/7.31.3
Accept: */*
Postman-Token: 3162d0ea-ab8c-42bb-9a88-7c9cad2bc8f5
Host: xxx
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 261
Cookie: authentik_csrf=J0KBNeRsf24eJ6JuAPmdbG488tZfYHj2; authentik_session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOiJ2MjM3ZWdnMGw1eGJtN3Uzd2RmdjV1eXNob210eHZleSIsImlzcyI6ImF1dGhlbnRpayIsInN1YiI6ImFub255bW91cyIsImF1dGhlbnRpY2F0ZWQiOmZhbHNlLCJhY3IiOiJnb2F1dGhlbnRpay5pby9jb3JlL2RlZmF1bHQifQ.6BuuBo74gDDu9EqK1_Uw9TM1mm6K6k6XYIVYHGiREBI
 
refresh_token=u%266Ha_.SYp%5C%5CS%23%60i%7D'-q%3A%3D%3F1dzie'%5C%22p%7B2g2%3A(G1%3E%40eO%5Bt%3CMd%3F.C%25t%60EB)d9%5B%3FP%5D7DeJoBWDW%3F))Bw8c8Fa88%60%7C%3E%2B%40I!Xy%3BgbfiA1Nowj9(%3BbD%25J)0%5BJxSN0iW%252w%40%7B%5BzY&grant_type=refresh_token
 
HTTP/1.1 400 Bad Request
Server: nginx/1.22.1
Date: Fri, 24 Mar 2023 20:57:38 GMT
Content-Type: application/json
Content-Length: 176
Connection: keep-alive
Cache-Control: no-store
Content-Encoding: gzip
Pragma: no-cache
Referrer-Policy: same-origin
Vary: Accept-Encoding
Vary: Cookie
X-Authentik-Id: 118c3d3aedcb4f66acf2dfb767686f69
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Powered-By: authentik
 
{"error": "invalid_grant", "error_description": "The provided authorization grant or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client"}

and here's the refresh token from authorization code exchange

{
    "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjgxMzk5NTVmZTBmMmZlOTZlMGUyMjA5ZDg0NDliMDMzIiwidHlwIjoiSldUIn0.xxxwczovL2FjY291bnRzLnNta3RocGF0aS5zY2guaWQvYXBwbGljYXRpb24vby9lbmppbi1yb3Nocy1wdWIvIiwic3ViIjoiN2I0ZDQ3NjdhNDY0MDEzOTY3MGZkM2QyNDkzZDQwNmUyMmFkNGFjZmQ0ODIwNzE2NzUyNGU2OWQ5ZGNmNjM1MSIsImF1ZCI6ImE4YmYyZDA1YjM1MDk5MTQ5ZjAxYjRhOTFkNTQ5YzVhOTM0Mzc0NTAiLCJleHAiOjE2Nzk2OTE2MjAsImlhdCI6MTY3OTY5MTMyMCwiYXV0aF90aW1lIjoxNjc5NjU0NzYwLCJhY3IiOiJnb2F1dGhlbnRpay5pby9wcm92aWRlcnMvb2F1dGgyL2RlZmF1bHQiLCJlbWFpbCI6InRyYXBlcndhemVAZ21haWwuY29tIiwiZW1haWxfdmVyaWZpZWQiOnRydWUsIm5hbWUiOiJkaW1hbmRhIiwiZ2l2ZW5fbmFtZSI6ImRpbWFuZGEiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJkaW1hbmRhIiwibmlja25hbWUiOiJkaW1hbmRhIiwiZ3JvdXBzIjpbImF1dGhlbnRpayBBZG1pbnMiXSwiYXpwIjoiYThiZjJkMDViMzUwOTkxNDlmMDFiNGE5MWQ1NDljNWE5MzQzNzQ1MCIsInVpZCI6Im5hcEhTSFpJdTc4ZlhEYnFLYkozUFZvRHZHc0F0VjNHcEVmblRGclAifQ.d0VIuNpWvhp9sfkT75_3LF3lYf-igOaU5HppHTn4alBrrsQWmF7ZQM2OxmPVprGcv0P6fQgc-SwEEBOm0sx0TfdWXGuQusMzheD958XC8RfWgx0Tskw0UlBwgB6-X67x9-m38Qo6JS4kowMG15ATMI2iDJUA6eEAj0oRCTcgVT5yEZMd7BdUZaIXIjnp7FRP7JzhI_SNtQuj0u_8Q54tpUTF7jlsmvOFJ4z5-2X564x7vnXsRV1swVGcT5wE_livEkXX1L7MMBWhuZ0LlA2Jbxr1Oz6iaXvc-4Vikd8y57hW7hEJQ_SGAM---SMwyePoKxWVFERW5RFhA-0tRG05GVphcs-EfyrZyT_5daisBN2DmwtQHoHgI6IhKenovwgQC6oIkbPjyW3ewaTRaGHnEoPvvihQfiUDMkQyXi6_5bjIrfb4cQ86PTnZ5QqUztyBAey_5vVNHdq33-2joptmbdN-EX8pdp7fohXulojOVpiNnQ5cJ8uF4u-e-4mu-FBP-nsSq9yIFAakYY0izJw4pW-KPYpJhxk1m9VBmt7KIoMqfZL4AL5sna_bQqvtd6glS9xW5Dy73PuJhZp8vztVNToJp6RK1-u6t6Td7eGkxZ27jSXdGiRWO26IaMaTNwU3tq4KMQzhWOjlF-hAi_yuSdv0NO8AdxI9JqgQvunn9EM",
    "refresh_token": "u&6Ha_.SYp\\S#`i}'-q:=?1dzie'\"p{2g2:(G1>@eO[t<Md?.C%t`EB)d9[?P]7DeJoBWDW?))Bw8c8Fa88`|>+@I!Xy;gbfiA1Nowj9(;bD%J)0[JxSN0iW%2w@{[zY",
    "token_type": "Bearer",
    "expires_in": 300,
    "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjgxMzk5NTVmZTBmMmZlOTZlMGUyMjA5ZDg0NDliMDMzIiwidHlwIjoiSldUIn0.xxwczovL2FjY291bnRzLnNta3RocGF0aS5zY2guaWQvYXBwbGljYXRpb24vby9lbmppbi1yb3Nocy1wdWIvIiwic3ViIjoiN2I0ZDQ3NjdhNDY0MDEzOTY3MGZkM2QyNDkzZDQwNmUyMmFkNGFjZmQ0ODIwNzE2NzUyNGU2OWQ5ZGNmNjM1MSIsImF1ZCI6ImE4YmYyZDA1YjM1MDk5MTQ5ZjAxYjRhOTFkNTQ5YzVhOTM0Mzc0NTAiLCJleHAiOjE2ODIyODMzMjAsImlhdCI6MTY3OTY5MTMyMCwiYXV0aF90aW1lIjoxNjc5NjU0NzYwLCJhY3IiOiJnb2F1dGhlbnRpay5pby9wcm92aWRlcnMvb2F1dGgyL2RlZmF1bHQiLCJhdF9oYXNoIjoidEE5ZWREZmhycEctUU1pbGxXc3ZXQSIsImVtYWlsIjoidHJhcGVyd2F6ZUBnbWFpbC5jb20iLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwibmFtZSI6ImRpbWFuZGEiLCJnaXZlbl9uYW1lIjoiZGltYW5kYSIsInByZWZlcnJlZF91c2VybmFtZSI6ImRpbWFuZGEiLCJuaWNrbmFtZSI6ImRpbWFuZGEiLCJncm91cHMiOlsiYXV0aGVudGlrIEFkbWlucyJdfQ.X11ot16RMHfDvFFlbInTew6csNJXHsYbk-khtEQdZiqlUtVnfQl0fJSLwHKXnA34C0JZD3Eg3aeBDX3_EbKtYnzRu7LvVWDp9SQYmyEQvc134nf_y0swY1dWJC_QfZf5reVUK6sQ1SpB_hmWZuHBTTcAs7zrOt65Xu32MWekjVvQG7WCGtQyBQIoVU7Gj_kv5jEvQLvCofcaHQQJhb-e3Lekw48Waz5iYofN2vTNfx5T_LYb27bkQXEjHvMKP8Lib-42sVh8fQ70dhkpm_I0-IVTbknAYpbnQf4ZYe6Nga-chDKG3hj8RVe1pke8kARReRYRiUhn6arKHpaDkmHE1RocBPmPUUSlo4Cc0zy8fAefENdSMjkDylGfBHloT0TuTVXqMM_jCtWNrmLFQVGwfwg8LAD8K4dF3KXLeD1ep_rGdfO8yPaIIPamn8Ta8rlER_62Rs-I-IqzR1htU3R0Yiu83wgMh52s1kBL7tY3YEzaZ8CI5pgvTJQDZCIs1TwM40yr51T0HOj7WvNeBCDdFVp14Yhwcppm9lR8lkpWHEDKd3fMG36LWCZ2HP4xA9Wt6XSZYD4M8sTYFGTPxW0GzM3g46hNW8TQpOqA_ej6yZCAB72oXMwzkjiWvHZA3vFQfpL2k0ZDCm_6rBNUQukdcZPessFSOF4o-n6H8ORM-AE"
}

[psi-sudhanshu]

Hello @9d4 @BeryJu,
I am also facing the same issue, the flow works fine if the issued refreshToken does not have backward slash(\) but it fails if refreshToken has that. Could this be a possible reason for this issue.

refresh_token which is working,

"refresh_token": "|,Io8B9@RM%)2~TCsopS^<XP~01KATkdW}n#Z<$)tdl^=0<:hEqtwr$%P}L*%B(BEY5R-!a7o4P!M}fc5UP^,=0s8-bzK-sxHOzeBE'A=2ae^N/+ZBXi;_[<y?c)Aa"

refresh_token which not working,

"refresh_token": "+r|6F,r,$>%R?~>CF*Nc$55,;7.=N<l$su6vMZqet..{k$yeEP#Pk!<\QG_MU\y8Y\H&s/DVC^HdPW,ZS;]^gcDEr20'@lE4CrNv#vl2aac@$bwDir#?O?_mHcf.zl"

Refresh token which failed was neither revoked nor expired at the time of calling. But calling it throw below error and log the "Refresh token does not exist" in authentik-server

{
"error": "invalid_grant",
"error_description": "The provided authorization grant or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client"
}

{"auth_via": "unauthenticated", "event": "Refresh token does not exist", "host": "authentik.xyz.com", "level": "warning", "logger": "authentik.providers.oauth2.views.token", "pid": 9502, "request_id": "ec8b1f3a68b0473c9a48f50d6bdd6bb8", "timestamp": "2023-05-06T11:40:12.816590", "token": "+r|6F,r,$>%R?~>CF*Nc$55,;7.=N<l$su6vMZqet..{k$yeEP#Pk!<\QG_MU\y8Y\H&s/DVC^HdPW,ZS;]^gcDEr20'@lE4CrNv#vl2aac@$bwDir#?O?_mHcf.zl"}

[9d4]

Currently I use earlier version of Authentik, where it does not send very random refresh token.

[psi-sudhanshu]

Thanks @9d4 , can you please confirm the version and did you observe any such issue with that version.

[9d4]

I use v2023.1.1, and I feel everything works just fine

[BeryJu]

This should be fixed with #5502

[psi-sudhanshu]

Thanks @BeryJu, can you please confirm which version will going to have this fix, and meanwhile shall we use version v2023.1.1 to make the sso work in our application.