I am posting this here, as Docusign has requested all docusign api questions be placed on StackOverflow:
REFERENCE
I have been working on a Docusign application that uses their OAuth flow. In order to test this, I have been using my free account (www.docusign.com) to get access tokens from the application I created on my developer account (demo.docusign.net).
The integrator key I am using is live.
In the process of my testing, I have obtained an access token 10 times using the free account. I did not keep track of those tokens as it states that they can be revoked in the web console. Docusign Reference
However, there is no such section in the www.docusign.com account. All it shows is 5 other accounts that I can connect to.
I now have lost all 10 of those tokens, and the response from the service tells me that I reached the maximum number of access tokens.
Now here's the interesting part, if I use my developer account credentials to authenticate to my application, I can see the access tokens that are active, with the option to revoke.
I know that there is a revoke token endpoint, but you need to know the token in order to use it.
How can I revoke these 10 tokens as I no longer know what they are (due to testing), and there is no interface to revoke them on www.docusign.com? Essentially, this account is now locked out of my application.
I cannot add screenshots to this post as I do not have high enough reputation
Related
I'm looking into DocuSign's eSignature API. Trying out their 0Auth using a demo account (https://developers.docusign.com/platform/auth/authcode/authcode-get-token/).
In some 0Auth systems, the access token of a given user gets invalidated after requesting another accessToken for the same user. But it seems previous token continues to be valid as long as it hasn't expire.
Is this a behaviour just for the Demo/Sandbox account or it is possible to rely on behaviour for live accounts as well? (Where several access tokens can be used for the same DocuSign user?
Can each of these accessTokens be refreshed with their respective refreshTokens without limitations/problems?
in this regard, Demo and Production behave the same - you can generate multiple valid tokens for the same user.
That said, this is not a good practice - while the Account Server does not currently have throttles related to token generation, it may in the future. A token should be re-used throughout its lifespan - continuously generating unnecessary tokens is not an appropriate workflow.
In order to access resources in Azure AD web applications we retrieve an authorization code using the following workflow:
https://learn.microsoft.com/en-us/azure/active-directory/develop/v1-protocols-oauth-code
Now my questions is, does this retrieved code also have a specific lifetime (like tokens have) or will it never expire? I guess it won't expire but I need to be sure about that.
Yes, the authorization code has a lifetime of 10 minutes I think.
You use it to get the tokens you need and then throw it away.
You'll get refresh tokens so you can use them to get more tokens later.
ADAL.NET for example handles the token refresh for you, assuming you properly implement a token cache.
Reference: https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-id-and-access-tokens (scroll all the way down) (it's for the v2.0 endpoint, but codes are similarly short-lived in v1)
Authorization codes (work or school accounts)
10 minutes
Authorization codes are purposely short-lived, and should be immediately redeemed for access tokens and refresh tokens when the tokens are received.
Background
We have a feature that syncs calendar entries and contacts between our application and Office365, using the Office365 REST apis outlined here. We are using Version 1 of the API. For authorization we are performing authorization via Azure AD as outline here.
Problem
In the normal case (when using Office365 accounts purchased directly from Microsoft), our system works as expected: we are able to refresh the user's tokens when they expire and are returned a new access and refresh token in exchange.
In the second case, when testing with Office365 accounts purchased via GoDaddy, we encounter a blocking issue that can be outlined in this series of steps:
1. User is sent from our app -> Office365 Login page.
2. User enters email address
3. User is redirected to GoDaddy Office365 login page.
4. User completes authorization, and is redirected back to our app with an access code in the response.
5. App exchanges access code for an access_token and refresh_token from Office365.
6. Some time goes by, and access_token expires
7. App refreshes the user's access_token using the refresh_token
Expected Behaviour
At this point we are expecting to receive a new access_token as well as a new refresh_token, as we do when using a regular Office365 account
Actual Behaviour
Only for accounts purchased via GoDaddy, we do not receive a new refresh token in the response after refreshing for the first time.
Obviously when intending to have a long-running sync, this is a breaking case as the user will no longer be able to have their tokens refreshed beyond this point.
Postman traces (can save as .json and import to Postman for debugging
https://gist.github.com/drunkel/7ec66ed33f66d0070148694651699d03 (IDs and secrets have been removed)
Question:
Is this a known issue?
Is there a workaround?
I am a Software Engineer at GoDaddy and can confirm that this issue has been resolved. The reason for more frequent login requests under Modern Authentication is that as these are federated users and as you mentioned in your question, the refresh token was not being returned. This was caused by the StsRefreshTokensValidFrom attribute on the AAD user not being updated properly.
Every provider can decide how to implement its own oAuth server with certain policies on how to act with certain grant type and policies about granting/revoking refresh tokens/id tokens/access token and their lifetime properties.
This is a known issue with go daddy when purchasing office 365 accounts. see here and also here and here.
So it seems like GoDaddy decided to implement their OAuth server with a restricted security policy about refresh tokens by not enabling and not sending back a refresh token to the API calling the OAuth authentication and authorization when you purchase office 365 accounts through GoDaddy.
This is security enhancement/block to disable your application not to hold a lifetime refresh token that can be lived forever (if refreshed) to these office 365 accounts purchased on Godaddy
Usually, OAuth servers implemented with integration with Azure Active directory have the following token lifetime (but you can change and decide to override configure them differently 3rd party implement their own server with their own policies about tokens)
Another important featurw which Go Daddy does not support multi-factor authentication(mfa) for office 365 accounts found here.
Azure lifetime policies:
Azure Active Directory Configurable token lifetime properties
Another important issue is that if you want to be able to continue to refresh the token while the user is offline you must ask the user for access_type="offline", so during a time of inactivity from the user, you can continue to refresh the token and to hold long lifetime token for the account.
If the user decides to revoke the token for any reason - the token immediately expires.
Another issue in the steps you described is:
User is sent from our app -> Office365 Login page.
User enters email address
The user is redirected to GoDaddy Office365 login page.
so now the refresh token for office 365 flow from server to the hands of Godday servers.
User completes authorization and is redirected back to our app with an access code in the response. (but without the refresh token obtained the in the last server to server step. Godaddy to keep security on behalf of 365 accounts keeps it to itself and not returning it to the end user.
The app exchanges access code for an access_token and refresh_token from Office365. 6. Some time goes by, and access_token expires 7. App refreshes the user's access_token using the refresh_token
I am looking to using OAuth to secure some web services. OAuth 2 fits nicely for the use cases I have where the user might access his/her own data using API's or grant access to someone to call API's on his behalf.
However, the initial set of API users are not very technical and they would not want to go through the effort of making API calls just to generate tokens. I am thinking of implementing the following solution but am not sure if this is the right way.
If the user is a developer, then
Have a screen where he/she can register an application. This will generate an API key/secret pair.
To access his/her own data (For 2 legged Auth) have a UI screen where the user can generate a access token for one his registered applications. He can specify the scopes and duration in the form.
If he is a 3rd party developer, then he needs to pass his applications API key to the person on whose behalf he needs to access the API and get an access token in exchange.
If the user wants a another application/developer to access API's on his behalf then
Have a screen where he can enter the third party's API key, scopes and the duration of the authorization. He can pass the generated access token to the developer who'll access the API's
I am going to use same OAuth libraries to generate the token that I would have used if I had gone the web service route. Further, I can also develop services whenever the current situation doesn't scale or the need arises and the existing tokens would still work.
The problem is mainly one of security. By design, duration of access token should not be set by a client. If someone else gets to know the access token and client id during this duration, this user's account will be compromised. Normally this duration is set to be not very long and a second secret value refresh token is used to refresh the current access token. The token refreshing can be automated in code, but in your approach it will need to be done manually.
I have using docusign node module for using embedded signing flow. Things have been working fine but suddenly we have started seeing errors such as access token limit exceeded.
Here is the error
Description: Maximum number of access tokens exceeded.
at /Users/amitagwl/Projects/Personal/support.birdeye.com/node_modules/docusign-node/components/auth.js:105:17
Questions:
In quick look up I found that production accounts have 10 as token limit. Why is that ? If I have exceeded the limit, does it mean I can't use my account any more ?
Can I reuse existing token ? How do I see my previously created token ?
Each application is allowed 10 tokens per authenticated user. In other words your app can connect to a user's account only 10 times. The tokens can (and should) be reused. Typical apps will require only one token for each user - or one token for each account of Send-On-Behalf-Of is used.
In general you should authenticate once, get the token, store that token, and use it for future access to that user's account. The user may revoke that token at any time so your app should prompt for authentication if necessary.
I got the answer. Tokens can be revoked under "connected apps". (Classic experience only).