Refreshing a token does not work based on the proposed configuration

[korneliuscode]

I ran into an issue with the proposed configuration. This is the suggested config:

OAUTH_AUTHORITY=https://login.microsoftonline.com/common
OAUTH_ID_METADATA=/v2.0/.well-known/openid-configuration
OAUTH_AUTHORIZE_ENDPOINT=/oauth2/v2.0/authorize
OAUTH_TOKEN_ENDPOINT=/oauth2/v2.0/token

wreck inside simple-oauth2 uses Url.URL to combine OAUTH_AUTHORITY with OAUTH_TOKEN_ENDPOINT which results in https://login.microsoftonline.com/oauth2/v2.0/token and therefore loses common. This results in a 404.

I changed the config slightly and removed the leading slashes from the relative paths and added a trailing slash to the base URL.

OAUTH_AUTHORITY=https://login.microsoftonline.com/common/
OAUTH_ID_METADATA=/v2.0/.well-known/openid-configuration
OAUTH_AUTHORIZE_ENDPOINT=oauth2/v2.0/authorize
OAUTH_TOKEN_ENDPOINT=oauth2/v2.0/token

So that OAUTH_TOKEN_ENDPOINT is relative. I have not figured why it worked for authorize though, but still works.

[jasonjoh]

Interesting. I haven't run into this. What version of simple-oauth2 and wreck are you using?

[korneliuscode]

It's "simple-oauth2": 3.1.0" and "hapi/wreck": 15.1.0

[jasonjoh]

Hmm. Same here. What OS are you running on?

[korneliuscode]

My devbox is windows 10. No production yet.

[jasonjoh]

I was finally able to reproduce this. The reason authorize works is because the app uses passport for that, not simple-oauth2.

Thanks for reporting, I'll get a fix for this shortly.