Problem with OAuth2 refresh token

Question

I have the following problem with the simple_oauth module.

1. I can get the initial jwt token with a POST request to /oauth/token with the following form data:

   username: user
   password: password
   client_id: xxxx
   client_secret: yyy
   scope: oauth
   grant_type: password
   

2. This token has the actual access token and the refresh token. So I have an interceptor in Angular to refresh the token when we get a 403 return code. The call to refresh the token is again a POST request to /oauth/token with a slightly different payload:

   client_id: xxxx
   client_secret: yyy
   scope: oauth
   grant_type: refresh_token
   refresh_token: def5020092674bfb5c570c518c112fbc78ec6ddb2d...
   

3. This call also succeeds but when I try to use the returned token I will get 403 returns. It is like the tokens produced using one grant type or the other have different scopes...

Have you experienced this problem? Do you know what can I do to solve it? Thank you very much in advance.

Answer 1

Status code 403 (Forbidden) does not mean that you are not properly authenticated. Since you received all tokens properly you are authenticated successfully. 401 Unauthorized means that you do not have a proper token, i.e. you are not authenticated).

If you receive 403 then you simply are not allowed to access the requested resource with the token you presented. The account you used does not have access privilege for whatever you are trying to access.

If I would have to guess:

1. Either you used the wrong account (e.g. Stage account used on Production) => use the correct account
2. Your account was not set up to access the endpoint. => talk to whoever created the account

Edit: It comes down to "Authentication != Authorization" ("who am I" vs. "what am I allowed to do").