[英]Trying to understand OAuth2 refresh_token flow - keep getting invalid_grant
My understanding of the refresh_token flow ( http://wiki.developerforce.com/page/Digging_Deeper_into_OAuth_2.0_on_Force.com ) is as follows: 我对refresh_token流程( http://wiki.developerforce.com/page/Digging_Deeper_into_OAuth_2.0_on_Force.com )的理解如下:
When I attempt to get the initial token using "password" grant on behalf of the user, the subsequent "refresh_token" fails. 当我尝试代表用户使用“密码”授予来获取初始令牌时,随后的“ refresh_token”将失败。 What am I doing wrong ? 我究竟做错了什么 ?
Consider the python example below: 考虑下面的python示例:
#!/usr/bin/env python
import requests
import sys
from optparse import OptionParser
import json
usage = "usage: %prog [options] arg"
parser = OptionParser(usage)
parser.description = """Get a login token from salesforce
"""
parser.add_option("-u", "--username", dest="username", help="User name")
parser.add_option("-p", "--password", dest="password", help="User password")
parser.add_option("-t", "--securityToken", dest="token", help="User's security token")
parser.add_option("-i", "--client_id", dest="client_id", help="OAuth client_id (aka SF Consumer Id)")
parser.add_option("-s", "--client_secret", dest="client_secret", help="Client Secret (aka SF Consumer Secret)")
(options, args) = parser.parse_args()
resp = requests.post('https://login.salesforce.com/services/oauth2/token', params={
"grant_type":"password",
"client_id":options.client_id,
"client_secret":options.client_secret,
"username":options.username,
"password":options.password + options.token,
"redirect_url":"https://localhost:8080/ls/api/oauth"})
accessInfo = json.loads(resp.text)
access_token = accessInfo["access_token"]
print "Initial Token:", json.dumps(accessInfo, indent=4)
resp = requests.post('https://login.salesforce.com/services/oauth2/token', params={
"grant_type":"refresh_token",
"client_id":options.client_id,
"client_secret":options.client_secret,
"refresh_token":access_token,
"redirect_url":"https://localhost:8080/ls/api/oauth"})
refreshInfo = json.loads(resp.text)
print "Refresh token:", json.dumps(refreshInfo, indent=4)
您不会获得带有用户名/密码流的刷新令牌,因为(a)您拥有用户的密码,并且可以在需要时获取新的访问令牌,并且(b)无法获得用户的授权,这基本上就是刷新令牌表示。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.