OAuth2 Token Management in File Access Manager

OAuth2 Minisite or OAuthWebsite

The OAuth2 minisite is deployed to ease the management of File Access Manager's interface to OAuth2-based services. The minisite enables storage of all provider-specific configuration in a unified location, thus enabling us to modify it from a single location.

The minisite provides the following:

  • Storage of global info, including provider specific information:

    • ClientId

    • ClientSecret

    • URL for user authentication

    • URL for token requests

    • Scope, for providers that allow dynamic permission requests

  • Handling of OAuth2 flow operations:

    UserRequest.ashx

    Redirecting the end user to the appropriate provider's website to start the authentication process.

    Callback.aspx

    The target of Redirect URI, extracting the User Authorization Code or error message from a query string and displaying it in a user friendly format.

    AccessToken.ashx

    Encapsulating initial requests for access tokens, exchanging a User Authorization Code for a Token Set.

    RefreshToken.ashx

    Encapsulating requests for token refresh, exchanging a Refresh Token for a new Token Set.

Agent Configuration Manager - TokenRefreshServer

This central service is responsible for refreshing all OAuth2 tokens automatically and providing a token retrieval interface for other File Access Manager components.

The logic described here is implemented in: AgentConfigurationManager\src\TokenRefreshServer.cs

  • Interface Operations

    • Upon token request, the requested token is sent as a response

    • If no such token is loaded, the service attempts to load it from the database

  • Automatic Operations

    • Upon startup, the service loads all available tokens from the Business Application Management (BAMs') (application's) configurations

    • Whenever a token is approaching expiration, it is automatically refreshed and updated in the database

    • If a token refresh fails, the token is removed from the memory cache

      • This mechanism allows automatic release of expired or failed tokens and protects the service from endless refresh attempts

        Note: Failed Refresh – there are various reasons for a failed refresh, such as modified or deleted consent user, expired app key, network errors etc.

      • A token reload and refresh is re-attempted if or when it is requested again through the ACM token management interface

  • TokenRefreshServermust is the only File Access Manager component that executes token refresh operations

    • Provides a solution for security mechanisms where upon refresh, all tokens are canceled except for the latest

    • A centralized point for token management makes for easier logging, debugging, and troubleshooting