Refresh Token - Dynamics CRM

[SweetAction]

Before I go digging into what's happening and spend a couple hours, I figured I would ask here to see if anyone can shortcut me the pain.

Dynamics CRM, setup and successfully working. At some point (days? weeks?) the refresh token stops working. Doing a test gives a detailed error that the refresh token has expired.

Per a few other threads, linked below, the token should be good for at least 90 days, possibly forever as long as there is activity on the system. There's roughly 4300 calls a day on the system, so it's not that as CRM is set to query on all calls, and it's happening in under 1 months time for sure.

90 day post: https://www.3cx.com/community/threads/authentication-to-call-dynamic-365-crm-api.88099/post-521625
New refresh on every query (so it won't ever expire): https://www.3cx.com/community/threads/oauth2-custom-crm-fails-to-refresh-token.113933/post-527456
Another post about it not expiring: https://www.3cx.com/community/threa...ion-with-microsoft-dynamics.71498/post-318218
Another post: https://www.3cx.com/community/threads/dynamics-365-refresh-tokens-access-policies-changes.78739/

So, does anyone know what can cause a token to expire?

 

[edossantos]

Hello,

What version of 3CX are you using? Can you also check the version of the Dynamics template? You can see this from the 3CX Console > Settings > CRM > Dynamics > Show Template, and the second line of the XML will tell you the version.

This is something that we fixed long time ago. In old versions of the template, the refresh token was generated during the authorization phase (when you click Authorize), and not updated anymore. But at some point, Microsoft started revoking old tokens, and we made a fix to always keep an up to date refresh token. Every time we ask for an access token, Microsoft returns a new refresh token, and we update it internally, so the next time we ask for an access token, we use the updated refresh token.

If you have a very old refresh token, the options I can imagine are:
1) Your template / 3CX installation is old, and is not storing the updated token.
2) Your system is not having much activity, so the token is not renewed frequently, but from what you say this would not be the case.
3) You might be restoring an old backup which includes an old token in the configuration.
4) Maybe your Dynamics installation is configured to revoke tokens more frequently, and not after 90 days (I'm not sure if this is possible though, as I don't know Dynamics with such detail).
5) Someone is manually revoking the token from the Dynamics side.

 

[SweetAction]

Hello,

What version of 3CX are you using? Can you also check the version of the Dynamics template? You can see this from the 3CX Console > Settings > CRM > Dynamics > Show Template, and the second line of the XML will tell you the version.

Version 17. Is this a version affected by the issue? That should be newer then the version that shipped with v16 update 7 (my last link in my first post).

I can bring over version 18 if need be, but how does a template normally get updated? With SIP Trunks, you have to delete and recreate - PBX updates don't update existing templates - so I'm wondering if CRM templates are the same?

4) Maybe your Dynamics installation is configured to revoke tokens more frequently, and not after 90 days (I'm not sure if this is possible though, as I don't know Dynamics with such detail).
5) Someone is manually revoking the token from the Dynamics side.

I'll have to check on these.

 

[edossantos]

Version 17. Is this a version affected by the issue? That should be newer then the version that shipped with v16 update 7 (my last link in my first post).

This is the latest version prior to 3CX v18 Update 8, and it includes the fix. So the refresh token should be updated with it.

I can bring over version 18 if need be, but how does a template normally get updated? With SIP Trunks, you have to delete and recreate - PBX updates don't update existing templates - so I'm wondering if CRM templates are the same?

When you update your PBX, the CRM templates are updated with it. And you can also download the latest version from our updates server in case you deleted it. But in your case, you're already in the latest version for 3CX v18 Update 7, which is the latest stable release at the time being.

I'll have to check on these.

Please do, maybe an old backup being restored is the easiest way to explain this. Check if you're doing that.

 

[SweetAction]

We may have found the root cause. Can you confirm if auto-create contacts is turned off and no data exists in CRM, would the token be updated on every query?

 

[edossantos]

Can you confirm if auto-create contacts is turned off and no data exists in CRM, would the token be updated on every query?

Yes, the token would be updated in that case too, because it's a normal REST API call, no matter if the server returns data or not.