I'm working on a headless Drupal 8 API that offers direct login links via email. For users who forgot their passwords or were invited but have never logged in, it's safe to just reset their password.

Otherwise, is there a way to convert the ~80 character strings in simple_oauth's table oauth2_token.value back into a Bearer token?

My currently implementation only resets the password as:

public function handle_otp(String $code, User $user, Group $group, Request $request) {
        $hash = \Drupal\Core\Site\Settings::get('myhash');
        $shouldbe = md5($hash . $uservariables);
        if ($code !== $shouldbe) $this->returnError(array('This is an invalid link'));

        $tokens = \Drupal::database()->query("SELECT id FROM oauth2_token WHERE status = 1 AND expire < now() AND auth_user_id=:uid LIMIT 1", array(':uid'=>$user->id()))->fetchAssoc();
        if (empty($tokens)) { // its safe to reset their password since they have no tokens
          $password = user_password(10);
          $user->setPassword($password); // reset password so we can request tokns

          $params = array(
            "client_id" => \Drupal\Core\Site\Settings::get('client_id'),
            "client_secret" => \Drupal\Core\Site\Settings::get('client_secret'),
            "username" => $user->getEmail(),
            "password" => $password,
            "grant_type" => "password");

          $tokens = _run_curl($base_url.'/oauth/token', $params);          
          $tokens['randpass'] = $password; // give it back to the client to auto login
          $tokens['email'] = $user->getEmail();
        } else {
          // TODO: how do we convert oauth2_token.value to a Bearer token

        return $this->sendToClient($tokens, $request);

  • Check this out. git.drupalcode.org/project/simple_oauth/blob/8.x-3.x/src/Entity/… The tokens are stored in oauth2_token table. The expiry time is set in expire field and the current status is in the status field which is returned in the isRevoked function. So if you manipulate these you should be able to extend tokens I believe.
    – anoopjohn
    Nov 3, 2019 at 3:08
  • i did look at that table but the value column have only 80 characters strings. it seems these are some encoding of the token? I haven't reversed back further than that yet. (hence this question)
    – E.A.T
    Nov 3, 2019 at 5:56
  • Did you try changing the expiry time or the status columns and see if that has an impact?
    – anoopjohn
    Nov 3, 2019 at 6:46
  • @anoopjohn, all values i'm using have an active status and expiry... i've updated the question to focus the direction towards converting the oauth2_token.value to a bearer token
    – E.A.T
    Nov 3, 2019 at 21:18


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.