{"action":"created","issue":{"url":"https://api.github.com/repos/bluesliverx/grails-spring-security-oauth2-provider/issues/75","labels_url":"https://api.github.com/repos/bluesliverx/grails-spring-security-oauth2-provider/issues/75/labels{/name}","comments_url":"https://api.github.com/repos/bluesliverx/grails-spring-security-oauth2-provider/issues/75/comments","events_url":"https://api.github.com/repos/bluesliverx/grails-spring-security-oauth2-provider/issues/75/events","html_url":"https://github.com/bluesliverx/grails-spring-security-oauth2-provider/issues/75","id":64268330,"number":75,"title":"Cannot set unlimited refresh tokens in 2.0-RC3","user":{"login":"zgarbowitz","id":5741912,"avatar_url":"https://avatars.githubusercontent.com/u/5741912?v=3","gravatar_id":"","url":"https://api.github.com/users/zgarbowitz","html_url":"https://github.com/zgarbowitz","followers_url":"https://api.github.com/users/zgarbowitz/followers","following_url":"https://api.github.com/users/zgarbowitz/following{/other_user}","gists_url":"https://api.github.com/users/zgarbowitz/gists{/gist_id}","starred_url":"https://api.github.com/users/zgarbowitz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zgarbowitz/subscriptions","organizations_url":"https://api.github.com/users/zgarbowitz/orgs","repos_url":"https://api.github.com/users/zgarbowitz/repos","events_url":"https://api.github.com/users/zgarbowitz/events{/privacy}","received_events_url":"https://api.github.com/users/zgarbowitz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-03-25T13:28:30Z","updated_at":"2015-03-25T15:56:11Z","closed_at":null,"body":"Hi,\r\n\r\nWe just upgraded to 2.0-RC3, which includes Spring Security OAuth 2.0.6.RELEASE. According to springs release notes http://spring.io/blog/2015/02/02/spring-security-oauth-2-0-6-release-available-now, the new version should support refresh tokens that never expire by setting refreshTokenValiditySeconds to 0 in the client.\r\n\r\nHowever, I just tried that. When I hit /oauth/token to refresh a token, I get the following error:\r\n\r\n2015-03-25 13:11:06,700 ERROR [http-bio-8443-exec-10] org.codehaus.groovy.grails.web.errors.GrailsExceptionResolver      - IllegalArgumentException occurred when processing request: [POST] /oauth/token - parameters:\r\nscope: sdk\r\ngrant_type: refresh_token\r\nrefresh_token: ba17beca-ee34-484c-bd74-37f8eacbe8eb\r\nRefresh token must be capable of expiring. Stacktrace follows:\r\njava.lang.IllegalArgumentException: Refresh token must be capable of expiring\r\n\tat grails.plugin.springsecurity.oauthprovider.GormTokenStoreService.storeRefreshToken(GormTokenStoreService.groovy:112)\r\n\tat grails.plugin.springsecurity.oauthprovider.endpoint.WrappedTokenEndpoint.getAccessToken(WrappedTokenEndpoint.java:25)\r\n\tat grails.plugin.cache.web.filter.PageFragmentCachingFilter.doFilter(PageFragmentCachingFilter.java:177)\r\n\tat grails.plugin.cache.web.filter.AbstractFilter.doFilter(AbstractFilter.java:63)\r\n\tat grails.plugin.springsecurity.web.filter.GrailsAnonymousAuthenticationFilter.doFilter(GrailsAnonymousAuthenticationFilter.java:53)\r\n\tat grails.plugin.springsecurity.web.authentication.RequestHolderAuthenticationFilter.doFilter(RequestHolderAuthenticationFilter.java:49)\r\n\tat java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)\r\n\tat java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)\r\n\tat java.lang.Thread.run(Thread.java:745)\r\n\r\nIt's easy enough as a work-around to continue setting a very large refresh token expire time, but I wanted to point this out.\r\n\r\nThanks,\r\nZack"},"comment":{"url":"https://api.github.com/repos/bluesliverx/grails-spring-security-oauth2-provider/issues/comments/86093977","html_url":"https://github.com/bluesliverx/grails-spring-security-oauth2-provider/issues/75#issuecomment-86093977","issue_url":"https://api.github.com/repos/bluesliverx/grails-spring-security-oauth2-provider/issues/75","id":86093977,"user":{"login":"bluesliverx","id":391239,"avatar_url":"https://avatars.githubusercontent.com/u/391239?v=3","gravatar_id":"","url":"https://api.github.com/users/bluesliverx","html_url":"https://github.com/bluesliverx","followers_url":"https://api.github.com/users/bluesliverx/followers","following_url":"https://api.github.com/users/bluesliverx/following{/other_user}","gists_url":"https://api.github.com/users/bluesliverx/gists{/gist_id}","starred_url":"https://api.github.com/users/bluesliverx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bluesliverx/subscriptions","organizations_url":"https://api.github.com/users/bluesliverx/orgs","repos_url":"https://api.github.com/users/bluesliverx/repos","events_url":"https://api.github.com/users/bluesliverx/events{/privacy}","received_events_url":"https://api.github.com/users/bluesliverx/received_events","type":"User","site_admin":false},"created_at":"2015-03-25T15:56:11Z","updated_at":"2015-03-25T15:56:11Z","body":"Looks like this should be an easy fix, and for now you could workaround by overriding the tokenStore with a variant that supports non-expiring refresh tokens."}}