Oauth2 - custom CRM - fails to refresh token

[Kurt DV]

Hi,

I am the developer of a custom CRM solution based on Django. My client wants to integrate with their 3CX version 18.0 (Build 461) Professional license, for CRM contact lookup.
I integrated "Django Oauth Toolkit" in our CRM to handle the authentication part.
Then we used 3CX CRM Template Generator to build a template for our custom CRM.

I couldn't find any developer documentation on what 3CX expects as Oauth2 settings like:
- Authorization grant type (I used Authorization code)
- redirect uri ( I found by looking at other integrations to use <FQDN>/api/oath2crm )

In the 3CX > Advanced > CRM Integration panel, I configured client-id, client-secret and used the "Authorize" button to get a refresh token.
If I then use the "Test" button to send a contact lookup, it works the first time, but never the second time.
I believe it has to do with refreshing the 'refresh_token':
When I "Authorize" and press "OK" to save the integration, it keeps working until the refresh_token expires.

When I log with wireshark I get this kind of conversation:

3CX -> CRM : GET o/authorize?response_type=code&client_id=<client_id>&redirect_uri=<redirect_uri>&state=<guid>
CRM->3CX: 200 OK: page with authorize button
CRM->CRM: POST /o/authorize?response_type=code&client_id=<client_id>&redirect_uri=<redirect_uri>&state=<guid>
  +from with "allow"="authorize" etc.
CRM->3CX: 302: found, redirect with /api/oauth2crm?code=<CODE>
3CX->CRM: POST o/token/
  code = <CODE>
  grant_type="authorization_code"
  client_id=<client_id>
  client_secret=<client_secret>
  redirect_uri=<redirect_uri>
  state=<state>
CRM->3CX: 200 OK:
  {"access_token": "bPBXm1Od22euUi4sWkaYdhBhZZGpEF", "expires_in": 36000, "token_type": "Bearer", "scope": "read write", "refresh_token": "b2w9n3ndEU3jsV4Iot5CN2Ec7KznV9"}

-- now 3cx has received a refresh token and will use it to get a new access token -- but forgets to update the refresh token

3CX->CRM: POST /o/token/
  refresh_token=AgxHBbuhxHL8U3ki1bKoKORKI93uJp
  grant_type=refresh_token
  client_id=<client_id>
  client_secret=<client_secret>
CRM->3CX: 200 OK:
  {"access_token": "qmSAfOsnDxiAt4tMmr0BjZsDtDrVKw", "expires_in": 36000, "token_type": "Bearer", "scope": "read write", "refresh_token": "w9Z05yt3MMzTYmO38yn3HYKUUxT5bc"}
-- notice that the refresh token was updated !! --
3CX->CRM: GET /3cx/phonenumbers?phonenumber=5551234  
  Authorization: Bearer qmSAfOsnDxiAt4tMmr0BjZsDtDrVKw => this matches the access token above
CRM->3CX: 200 OK (nothing found: [] )

-- now trying TEST for the second time:
3CX->CRM: POST /o/token/
refresh_token=AgxHBbuhxHL8U3ki1bKoKORKI93uJp
  grant_type=refresh_token
  client_id=<client_id>
  client_secret=<client_secret>
CRM->3CX: 400 Bad Request: error: invalid_grant

Notice that the refresh_token AgxHBbuhxHL8U3ki1bKoKORKI93uJp is the one that is visible under the Authorize button in the 3CX CRM Integration panel, but I don't see it in the logs with the server.

Is there something you expect differently from an Oauth2 perspective ?
Do you have more developer documentation ?
How can I keep 3CX in authorized ?

 

[edossantos]

OAuth2 has different variants, some systems return a new Refresh Token every time they give you an Access Token. This is not the most common case, but happens sometimes, as in this case....

In order to solve this, you will need to store the updated Refresh Token. You can check the template we provide for Dynamics 365 as a reference, which does this. In this template, check the scenario with Id="Auth". You will see that, in addition to getting the Access Token, it generates a variable for the new Refresh Token:
<Variable Name="RefreshToken" Path="refresh_token" />

And then an output for it:
<Output Type="RefreshToken" Value="[RefreshToken]" />

That will cause that the updated refresh token is stored when you get an access token.