nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

refresh token

jhammer

Hi,

I have a python script that runs once a day and its jobs is to download a new refresh token from aiq.netapp.com.

This works great for one week but then it fails and I'm required to manually download a new refresh token. Then I can run the script for another week before I need to manually download it again.

I know that a refresh token is valid for 1 week but as the script update the token daily I do indeed have a fresh token that should work.

I have verified that the refresh token that the script recieve is different from the previous one so it does it job correctly.

Anyone have any idea why I experience this problem?

/Johan

Find more posts tagged with

Accepted answers

jhammer

Hi elementx,

I got a reply from bretta that this is a normal behaviour so have to download the refresh manually once a week.

Best regards,

Johan

All comments

bretta

This is how it was designed for personal tokens. As you can guess, this has to do with security best practices. Imagine that a user's token was compromised. If it could be renewed indefinitely, that increases the scope and danger of the security breach.

elementx

If you posted your script we could reason about it, but since you haven't, we can only speculate (which I won't do).

So I'll just say I'd try the refreshed token from a different script or with just curl to see if it really works. If it does, then you need to fix your script.

elementx

> This is how it was designed for personal tokens.

Where is that behavior documented?

jhammer

Hi Bretta,

Ok, I understand. Thanks for clarifying. 🙂

The documentation is not very clear about the behaviour.

Best regards,

Johan

jhammer

Hi elementx,

I got a reply from bretta that this is a normal behaviour so have to download the refresh manually once a week.

Best regards,

Johan

elementx

That's my point - if it's not clear or if it's assumed, then it's a (documentation) bug.

I still think that the answer is not correct (i.e. there may be a problem with your script).

When I last tried - but that was a while ago (I shot a PowerShell demo with AIQ, it's on YouTube) - I'd rotate my token and it worked.

jhammer

Hi,

This is my script. Hope you find something wrong with it. 🙂

/Johan

import requests, http.client, os, time, json

def open_refresh_token(refresh_token_file):
file = open(refresh_token_file,"r")
refresh_token = file.readline().strip()
file.close()
return refresh_token

def save_new_refresh_token(new_refresh_token, refresh_token_file):
file = open(refresh_token_file,"w")
file.write(new_refresh_token)
file.close()

def get_new_refresh_token(refresh_token):
conn = http.client.HTTPSConnection( "api.activeiq.netapp.com" )
conn_data = json.dumps( { "refresh_token": refresh_token } )

conn.request( "POST", "/v1/tokens/accessToken", conn_data )

# get the response from the HTTPS request
res = conn.getresponse()

if res.status != 200:
print( "Could not get new token data based on current refresh token:", res.status, res.reason )

conn_data = json.loads( res.read().decode( "utf-8" ) )

new_access_key = conn_data["access_token"]
new_refresh_key = conn_data["refresh_token"]
return new_access_key, new_refresh_key

def main():

refresh_token_file = "c:/users/sejha/Downloads/refresh-token.txt"

refresh_token = open_refresh_token(refresh_token_file)

new_access_token, new_refresh_token = get_new_refresh_token(refresh_token)

save_new_refresh_token(new_refresh_token, refresh_token_file)

main()

elementx

Hi @jhammer - okay, well at least we got to the bottom of this.

I still think it's a bug in documentation and leaving the current wording in place will continue to confuse users.

I get my other API tokens from various API providers and three providers I use often issue tokens that last forever (literally, I get tokens that never expire and I use that duration for a token that's "Read Only" - I use that one in Postman to examine data structures returned by the API), so in my mind unusually short duration should be clearly explained in the API docs, which it currently is not.

jhammer

Hi @elementx

I fully agree. About a week ago I did a request on github to get the documentation updated so hopefully it will be done soon.

jhammer

Hi,

@elementx @bretta

The documentation has now been updated and according to this clarification one should be able to

get a new refresh key programmatically for 90 days before one have to manually download a refresh key. In my case I can only get a new refresh key for 7 days so something is wrong.

------------------------

You should download and save the access token and refresh token for later use. Access tokens expire one hour after generation and refresh tokens should be regenerated every 7 days and installed in the application. After 90 days, you will need to manually login and obtain a new access and refresh token

------------------------------