You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Creating a new Offline Session and a Refresh Token for later obtaining Access Tokens
#43921
I have a scenario where a user is authenticated with a SPA for the application. Then, as the user sets up an integration, I want to create an entirely separate offline session with an associated refresh token that can later be used to obtain a shorter lived access token for the integration to function.
Unfortunately, I cannot simply use the decide code flow of oauth2 due to limitations with the device being integrated.
So, what I'm looking for some guidance on what steps can be taken to create the new offline session and get a refresh token for it.
A backend service will be used to create the session and refresh token, where I would have the client submit the access token, validate it, and use the subscriber id to know which user to create the session for, and stash the refresh token into a backend database for the integration to function.
This backend service is trusted, and may possess either client credentials and/or credentials for a service account with whatever needed permissions.
What doesn't work:
I'm not able to see a way to log in the user via oauth2 REST calls without supplying a user's password. So that doesn't work.
All of the more recent token exchange functionality seems to associate the token with the same session. So that will not work, because if the user logs out of the web interface
Impersonation may be the correct option, but I'm not sure if you can create impersonated offline session, or what ramifications there might be doing it this way.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
I have a scenario where a user is authenticated with a SPA for the application. Then, as the user sets up an integration, I want to create an entirely separate offline session with an associated refresh token that can later be used to obtain a shorter lived access token for the integration to function.
Unfortunately, I cannot simply use the decide code flow of oauth2 due to limitations with the device being integrated.
So, what I'm looking for some guidance on what steps can be taken to create the new offline session and get a refresh token for it.
A backend service will be used to create the session and refresh token, where I would have the client submit the access token, validate it, and use the subscriber id to know which user to create the session for, and stash the refresh token into a backend database for the integration to function.
This backend service is trusted, and may possess either client credentials and/or credentials for a service account with whatever needed permissions.
What doesn't work:
Impersonation may be the correct option, but I'm not sure if you can create impersonated offline session, or what ramifications there might be doing it this way.
Any help is greatly appreciated. Thanks
All reactions