I'm trying to create a REST Web Services custom connector to NetSuite, using the following security settings:
Identity Provider: Generic Oauth 2
Authorization URL: https://********.app.netsuite.com/app/login/oauth2/authorize.nl
Token URL: https://********.suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token
Refresh URL: https://********.suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token
Redirect URL: https://global.consent.azure-apim.net/redirect
In NetSuite's side I created the necessary Oauth 2.0 role and integration. When I try to connect it opens a browser window for me to login to my user, and it correctly authenticates. The connection works for the first 60 minutes, but then Power Automate is supposed to refresh the token by using the Refresh URL, which is answered by NetSuite with a "BadRequest" error, followed by an "AccessTokenExpired" error. This can only be solved by manually re authenticating the connection in the browser, which is of course not practical.
I went through this issue with NetSuite's support but they seem to think it's a problem with Power Automate.
Has anyone been able to successfully keep the authentication working for more than 60 minutes?
@abm The issue happens when the flow is triggered after 60 minutes have passed since the initial browser authentication. This happens because OAuth 2.0 initially gives you a token that's valid for only 60 minutes. Then the client is supposed to use the refresh URL to get a new token. And that's when Power Automate get a BadRequest error. After that the flow stops working because the initial token is expired.
My understanding is when the token expires you need to capture the error and request to the token endpoint using the refresh token it previously received, and will get back a new access token it can use to retry the original request.
To use the refresh token, make a POST request to the service’s token endpoint with grant_type=refresh_token, and include the refresh token as well as the client credentials.
The response will be a new access token, and optionally a new refresh token, just like you received when exchanging the authorization code for an access token.
Looks like you got a flow which using the connector and running for more than 60 minutes so that means you need to capture the error handling inside flow to get next request for the refresh token.
Thank you @abm, but I believe that would only be necessary if I was handling the OAuth2 authentication myself. But Power Automate supports OAuth2 natively, and takes care of refreshing the token from the service’s token endpoint.
Agreed it should have been nice if it was automatically authenticates but looks like the error you are getting says that token is expired. If you compare with standard or signed third party connector might handle that. The custom connectors still have gaps compared to standard connectors. I have seen other posts related to standard vs custom connectors which some of the behaviours are different.
Alternate solution which I can think is capture the error handling in your next step and authenticate again. Is that a possibility?
@abm Unfortunately handling the error in the next step and trying to authenticate again just results on the same bad request error when the flow tries to refresh the token.
To clarify, the problem is not the token being expired. The problem is that NetSuite doesn't accept the flow's request to refresh the token, returning a bad request error. As a consequence the token it tries to use to authenticate is expired, but that's expected after failing to refresh it.
I'm still going back and forth with support but I guess I reached the attention of a level 2 support person who is now evaluating my custom connector.
I don't know what they'll come back with, but maybe there's a bug in saving the refresh url on the security details page, or maybe they could come back with how to edit the Swagger2.0 Source Code. I feel like this error on refreshing the OAuth 2.0 token is either a problem that affects all generic OAuth2.0 connections, or it's a NetSuite problem. They are currently reviewing a couple HAR files from my browser console to see what the request looks like after the token expired.
Three Super User rank tiers have been launched!
Features releasing from October 2020 through March 2021
We've updated and improved the layout and uploading format of the Power Automate Cookbook!
Fill out a quick form to claim your user group badge now!