Stateless .NET JWT based oauth2 authentication server

Question

First of all excuse my bad english.

I'm a newby in oauth2 and I'm trying to setup an authorization server with JWT tokens.

The server is running in a Owin self-hosted environment.

At this moment I've setup the token generation and it seems to work properly, I've also setup the refresh token provider and it seems to work (but it's just a minimal implementation); I didn't change the RefreshTokenFormat in the OAuthAuthorizationServerOptions leaving it to default (I don't know what is the default format), so the access-token is clearly a JWT token and the refresh token is something else.

All of this seems to work correctly, but I will need to run this authorization server in a microservices environment, so the authorization server service might be moved at any moment from one machine to another, so it needs to be stateless or at least to save needed informations on a shared storage (DB) or replicated local storage (I'm on Service Fabric) or some kind of distributed cache.

Testing I noticed that if I generate a refresh-token on a machine and then I try to use this refresh-token on another instance of the authorization server (on another machine) to get a new access-token, it fail with a generic invalid_grant error. My guess is that the auth server just keeps some token-related information in memory but I don't know exactly what and how.

I also would like someone to point me in the right direction to solve this issue.

Thank you very much.

Answer 1

I solved the situation using a JWT token also for the refresh token. This way the authentication server seems to be completly stateless.