Refresh Tokens are invalid after upgrade to 4.0.3 froom 4.0.1

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

You observe that refresh tokens generated in version 4.0.1 become invalid after you upgrade the environment to version 4.0.3. When you attempt a token refresh call, the system returns an invalid_grant error with the description 'refresh_token' is invalid. In the azserver logs, you see messages indicating that the session ID (sid) is revoked, which subsequently revokes the refresh token.

Environment

 

• Symantec Identity Security Platform (IDSP)
• Upgrade from version 4.0.1 to 4.0.3
• Hazelcast running on a single pod

 

Cause

The problem occurs when you have a specific combination of Tenant Settings and a single-pod Hazelcast configuration. If ssoMode is enabled and keepOldSessionIdOnNewRefreshTokenFlowWithOfflineAccess is set to true, the upgrade process or session handling in version 4.0.3 fails to recognize the existing sessions when Hazelcast is not running in a multi-pod cluster.

The following parameters in Tenant Settings trigger this behavior:

{
    "name": "ssoMode",
    "value": "enabledCookie",
    "origin": "tenant"
},
{
    "name": "keepOldSessionIdOnNewRefreshTokenFlowWithOfflineAccess",
    "value": "true",
    "origin": "tenant"
}

 

Resolution

To resolve this issue, you must increase the Hazelcast member count to at least two pods. Running multiple pods for Hazelcast ensures session stability during and after the upgrade.

1. Before upgrading, or during the upgrade process, adjust your Helm configuration to increase the Hazelcast pod count.
2. Run the following command to update your deployment (replacing placeholders with your specific environment details):
   
   helm upgrade ssp ssp_helm_charts/ssp -n ssp -f ssp-override.yaml --set hazelcast-enterprise.cluster.memberCount=2
   
   
3. Verify that multiple Hazelcast pods are running in the cluster.
4. If you cannot run multiple pods, you may set ssoMode to none or set keepOldSessionIdOnNewRefreshTokenFlowWithOfflineAccess to false in the Tenant Settings to avoid the token revocation, though this changes the expected session behavior.