error/Could not upgrade oauth token with Google OAuth

error/Could not upgrade oauth token with Google OAuth

by Dirk Grunwald -
Number of replies: 2

I've read through other errors concerning this report / message, but just wanted to see if people have experienced something like we went through.

We're using Google OAuth 2 in Moodle 3.5 using the built-in authentication module. We've used this for over a year without any problems. This past Wednesday evening at 6:30pm we got email messages saying that the token couldn't be refreshed (see below):

The refresh token for one of the OAuth services Google on your site https://applied.cs.colorado.edu has expired. This will limit the functionality of any plugins that use this service. To fix this issue, visit the OAuth 2 Services configuration page and click on the "Connect system account" icon in the table row for this service. Be sure to login using the same service account for the OAuth system each time.

This was disruptive for us because students were taking exams at that time. We tried updating the service account, but each time we did, we got the same upgrade message after the Google authentication / warning. We tried switching to another account -- same error messages. Enabling debugging didn't provide any useful error codes from the refresh warning

Eventually, we cleared the memcache instances that were running and things started working again.

At the end of the day, we have no idea what caused the problem to start or why it started working again. There were no errors in the SQL log (as others had seen) or in the main fpm-php logs.

There's a couple of things that are confusing here:

* if the refresh token fails, couldn't the existing authentication token continue to be used? This method seems to make the oauth method open to failure every hour

* have others seen similar temporary drops of access due to oauth?

Average of ratings: -
In reply to Dirk Grunwald

Re: error/Could not upgrade oauth token with Google OAuth

by Olaf Scharpf -

Hi Dirk,

came across your posting because I experienced the same issue. I'm using our school-server on linux for OAuth and so far I figured out that problems with refresh token started, when running cron.php, which does

Execute scheduled task: OAuth-Token für Servicekonten erneuern (core\oauth2\refresh_system_tokens_task)
... started 10:03:53. Current memory use 43MB.
... used 12 dbqueries
... used 0.3289041519165 seconds
Scheduled task complete: OAuth-Token für Servicekonten erneuern (core\oauth2\refresh_system_tokens_task)
So I stopped the cron-schedule and no further E-mails arrived concerning OAuth. No solution, of course....maybe another way is, to disable OAuth-cron-task in moodle: administration-> server-> scheduled tasks??

If you solved this in the meantime, please let me know.


Average of ratings: -
In reply to Olaf Scharpf

Re: error/Could not upgrade oauth token with Google OAuth

by Dirk Grunwald -

We never "solved" the problem, but it eventually went away. We're not certain what, if any, actions we took actually caused the problem to be resolved. I tried creating new OAuth tokens and reusing the tokens we had before. Again, not clear what resolved the issue.

Average of ratings: -