How can I include resource, scope, or additional attributes in the "get access token" call of a "grant_type=refresh_token"?

Scenario Complexity:

The "grant_type=refresh_token" call is necessary to obtain a new access token using a refresh token. A refresh token is a long-lived token that is provided to you during the initial authorization process. Its purpose is to allow you to request new access tokens without requiring the user to re-authenticate.

Access tokens have a limited lifespan for security reasons. When an access token expires, you could either prompt the user to log in again (which can be disruptive) or use the refresh token to get a new access token without requiring the user's intervention.

Example Request:

Here's an example of what the HTTP POST request might look like using cURL:

curl -X POST "https://auth.example.com/token" \
-d "grant_type=refresh_token" \
-d "refresh_token=your_refresh_token" \
-d "client_id=your_client_id" \
-d "client_secret=your_client_secret" \
-d "scope=desired_scope"
-d "resource=desired_resource"

For certain APIs, it's necessary to provide the resource, scope, or additional attributes when making a refresh token call to get a new access token.

Example APIs:

• Microsoft identity platform and OAuth 2.0 authorization code flow
  
• Okta API Refresh access tokens Call 

If you fail to include the desired resource, scope, or additional attributes in the token retrieval call, you might encounter an error similar to this.:

Test Failed: {
"error": "invalid_request",
"error_description": "AADSTS90009: 
Application \'0000-000-0000-0000-00000\'(xxxxx-xxx-xx....) is requesting a token for itself. 
This scenario is supported only if resource is specified using the GUID based App Identifier.
\r\n
Trace ID: xxxxx-xxx-xx....\r\nCorrelation ID: xxxxx-xxx-xx....
\r\nTimestamp: 2023-08-08 16:48:51Z",
"error_codes": [90009],
"timestamp": "2023-08-08 16:48:51Z",
"trace_id": "ff3616c7-e811-43d8-b40f-7749ab650101",
"correlation_id": "xxxxx-xxx-xx....",
"claims": 
"{\"access_token\":
{\"capolids\":{\"essential\":true,\"values\":[\"xxxxx-xxx-xx....\",\"xxxxx-xxx-xx....\"]}}}"
}

The remote server returned an error: (400) Bad Request. {
"error": "invalid_request",
"error_description": 
"AADSTS90009: 
Application 'xxxxx-xxx-xx....'(xxxxx-xxx-xx....) is requesting a token for itself. 
This scenario is supported only if resource is specified using the GUID based App Identifier.
\r\nTrace ID: xxxxx-xxx-xx....\r\nCorrelation ID: xxxxx-xxx-xx....
\r\nTimestamp: 2023-08-08 16:48:51Z",
"error_codes": [90009],
"timestamp": "2023-08-08 13:48:51Z",
"trace_id": "ff3616c7-e811-43d8-b40f-7749ab650101",
"correlation_id": "0d6de530-2a4a-48a5-8d7f-471138bbce4d",
"claims": "{\"access_token\":
{\"capolids\":{\"essential\":true,\"values\":[\"xxxxx-xxx-xx....\",\"xxxxx-xxx-xx....\"]}}}"
}

The remote server returned an error: (400) Bad Request.
Response Url: https: //login.microsoftonline.com/xxxxx-xxx-xxxx-xxxxx/oauth2/v2.0/token

Solutions:

Within the ZS OAuth Connection, the utilization of Extra Attributes for Token Requests facilitates the inclusion of resource, scope, or supplementary attributes within the Authorization or Token Request call.

 

Contact Us

If you have any further questions, please don't hesitate to reach out to us through our Live Chat or by sending an email to [e-mail].

https://zappysys.com/support/