fix: Correct OAuth2 parameter for IAS refresh token workaround

davidkna-sap · davidkna-sap · commit e379636c986e · 2026-01-12T10:08:10.000+01:00
diff --git a/cloudplatform/connectivity-oauth/src/main/java/com/sap/cloud/sdk/cloudplatform/connectivity/OAuth2Service.java b/cloudplatform/connectivity-oauth/src/main/java/com/sap/cloud/sdk/cloudplatform/connectivity/OAuth2Service.java
@@ -230,7 +230,7 @@ private void setAppTidInCaseOfIAS( @Nullable final String tenantId )
             additionalParameters.put("app_tid", tenantId);
             if( onBehalfOf == OnBehalfOf.NAMED_USER_CURRENT_TENANT ) {
                 // workaround until a fix is provided by IAS
-                additionalParameters.put("refresh_token", "0");
+                additionalParameters.put("refresh_expiry", "0");
             }
         }
     }
diff --git a/cloudplatform/connectivity-oauth/src/test/java/com/sap/cloud/sdk/cloudplatform/connectivity/OAuth2ServiceTest.java b/cloudplatform/connectivity-oauth/src/test/java/com/sap/cloud/sdk/cloudplatform/connectivity/OAuth2ServiceTest.java
@@ -244,7 +244,7 @@ void testSubdomainTenantStrategy()
                     2,
                     postRequestedFor(urlEqualTo("/oauth/token"))
                         .withRequestBody(containing("app_tid=" + tenant.getTenantId()))
-                        .withRequestBody(containing("refresh_token=0"))
+                        .withRequestBody(containing("refresh_expiry=0"))
                         .withRequestBody(
                             containing("grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer".replace(":", "%3A")))
                         .withRequestBody(containing("assertion=")));
diff --git a/release_notes.md b/release_notes.md
@@ -24,4 +24,4 @@
 
 ### 🐛 Fixed Issues
 
-- 
+- Fixed IAS OAuth2 token requests to use correct `refresh_expiry=0` parameter instead of `refresh_token=0` to disable refresh token issuance in certain cases.

Original file line number	Diff line number	Diff line change
`@@ -230,7 +230,7 @@ private void setAppTidInCaseOfIAS( @Nullable final String tenantId )`
`230`	`230`	`additionalParameters.put("app_tid", tenantId);`
`231`	`231`	`if( onBehalfOf == OnBehalfOf.NAMED_USER_CURRENT_TENANT ) {`
`232`	`232`	`// workaround until a fix is provided by IAS`
`233`		`- additionalParameters.put("refresh_token", "0");`
	`233`	`+ additionalParameters.put("refresh_expiry", "0");`
`234`	`234`	`}`
`235`	`235`	`}`
`236`	`236`	`}`
Original file line number	Diff line number	Diff line change
`@@ -24,4 +24,4 @@`
`24`	`24`
`25`	`25`	`### 🐛 Fixed Issues`
`26`	`26`
`27`		`--`
	`27`	+- Fixed IAS OAuth2 token requests to use correct `refresh_expiry=0` parameter instead of `refresh_token=0` to disable refresh token issuance in certain cases.