OAuth Token Exchange Expiration Period Is Not Calculated Correctly

[gary287]

The expiration period setting has a note below it that says "Consumer key/secret will expire if not used within X seconds after Oauth token exchange starts." It would be great if it worked that way but it does not. The consumer key/secret expires X seconds after the consumer is created. This is true regardless of whether you click activate or reauthorize on an integration. It is always based on the creation date of the consumer which does not change. Either the consumer creation date needs to be reset whenever a new token exchange starts or preferably the expiration date would be based on the creation date of the verifier token.

[arkadiych]

Thanks for reporting this issue. Internal issue MAGETWO-51292

[jim5359]

This problem breaks the Reauthorize. i.e. If you have an existing integration that's been authorized and click the Reauthorize now your integration is broken because it says the consumer key is expired. The only way to fix it is to delete the integration and create a new one from scratch.

[choukalos]

This fix is in review and will be merged to mainline soon; it's slated to be patched back into 2.0.x in an upcoming patch release.

[elenleonova]

The issue was fixed as a part of 2.0.6