Anyone else using the oauth2.0 user flow for authe...
# integrationss
SimonC
12/09/2023, 1:41 PMAnyone else using the oauth2.0 user flow for authentication to Restlet / REST? Do you find the 7 day expiry on refresh token annoying?
SimonC
12/09/2023, 1:43 PMYes I'm aware of the client machine to machine flow
s
Shawn Talbert
12/12/2023, 6:48 PMwhat's annoying? The user flow is meant to ensure a human end user is periodically authorizing access. It's not surprising [to me] that NS enforces that time period.
Shawn Talbert
12/12/2023, 6:49 PMIf you have a use case that truly includes a human, perhaps file a case with NS to see if they might extend that period?
Shawn Talbert
12/12/2023, 6:51 PMYou mention the client credentials flow, which is usually the answer when folks ask a question like this - in many cases they are doing a system-system integration but using the code grant flow, so that 7 day human involvement is a pain point.
s
SimonC
12/12/2023, 6:52 PMCan you imagine having to re authorise every app you’ve ever granted access to every week?
s
Shawn Talbert
12/12/2023, 6:52 PM(as it should be?)
s
SimonC
12/12/2023, 6:52 PMNightmare
s
Shawn Talbert
12/12/2023, 6:53 PMAgreed, but it seems to come up rarely as a real use case here in this forum. Perhaps NS is just paranoid since it is an accounting system and all that jazz.
s
SimonC
12/12/2023, 6:53 PMI understand the security aspect of it but I haven’t seen it elsewhere
s
Shawn Talbert
12/12/2023, 6:54 PMaye. as far as I know that 7 day period is not adjustable.
s
SimonC
12/12/2023, 7:00 PMAlso the difference between those 2 methods has nothing to do with expiration dates. With user flow, the user can allow access without having to interact with other party. With machine to machine a manual exchange and uploading of rsa cert needs to take place
s
Shawn Talbert
12/12/2023, 7:01 PMthat cert approach for machine-machine works out to effectively up to 2 year expiration dates.
Shawn Talbert
12/12/2023, 7:02 PMpossible hacky workarounds that I don't recommend would include using a Suitelet (available without login) instead of RESTlet, or switch to machine-machine with a privileged system account whereby individual user authorization is managed outside NS.
Shawn Talbert
12/12/2023, 7:05 PMI do generally get the impression that NS discourages the user flow, and a 7 day forced refresh expiration tends to support that.
2 Views