Refresh token reuse after rotation may cause intermittent invalid_grant with external OIDC provider

[croessner]

Title

[BUG] Desktop client sometimes fails refresh_token exchange with invalid_grant against external OIDC provider

Steps to reproduce

1. Configure the OpenCloud Desktop client against an OpenCloud server that uses an external OIDC provider.
2. In this setup, the external IdP is Nauthilus.
3. Log in successfully with the desktop client.
4. Let the client run for a longer period so token refresh happens in the background.
5. Eventually the desktop client hits a failed refresh request with grant_type=refresh_token.

Expected behavior

The desktop client should silently refresh tokens in the background and continue to use the newest refresh token without requiring re-authentication.

Actual behavior

After working fine for hours, the desktop client suddenly fails with an authorization error. On the IdP side, the failing request is a token endpoint request with:

• grant_type=refresh_token
• HTTP status 400
• response body {"error":"invalid_grant"}

From the user perspective this shows up as an "Access denied" style failure even though the session was previously working.

Why this issue may be different from existing desktop issues

This does not look like the same problem as:

• Feature: Refresh access token before it times out #763, which is mainly about refreshing access tokens before they expire to avoid unnecessary 401s
• Opencloud Client only show "Preparing the account" #819, which is mainly about setup/authentication flow problems with external IdPs
• Authelia: Problem with user roles #217, which is about claims/roles from external OIDC providers

This issue is specifically about a refresh token exchange that worked for a long time and then suddenly starts failing with invalid_grant.

Important note

On the IdP side, the token endpoint behavior appears correct.

The Nauthilus logs show that the failing requests are grant_type=refresh_token requests returning 400, and the server-side analysis indicates that the rejected token was already invalid, expired, or already rotated.

That means the interesting question is whether the desktop client may sometimes keep or reuse an outdated refresh token instead of the newest rotated one.

Questions

• Is there any known race or persistence issue in the desktop client's token storage?
• Could the desktop client under some circumstances retry with an already rotated refresh token?
• Are there code paths where the newest refresh token returned by the IdP is not reliably stored?

Environment

• Client: OpenCloud Desktop
• External IdP: Nauthilus
• OIDC flow includes offline_access

Additional context

I am seeing similar refresh-token-related failures on iOS as well, but this issue is specifically about the desktop client.

If useful, I can provide:

• desktop client logs with HTTP logging enabled
• matching Nauthilus token endpoint logs with request timestamps
• examples of successful refreshes followed later by invalid_grant

[willyp713]

Did you find a way to login with the desktop client after this issue? I'm stuck in an authentication loop on my desktop clients which makes them unusable.

[budimanjojo]

@willyp713 Me too.

I'm stuck here, clicking the button will just reload the same page.

[budimanjojo]

Setting PROXY_OIDC_REWRITE_WELLKNOWN to "true" on the server fixed it for me though

[github-actions]

This issue was marked stale because it has been open for 30 days with no activity. Remove the stale label or comment or this will be closed in 7 days.

[willyp713]

I found a workaround to get out of the authentication loop, but it's not great. I had to clear out the account info in opencloud.cfg and I had to do this on both Windows and Mac. Then I could finally login and resync files.

At first I tried uninstalling on my PCs and starting a fresh sync folder, which sort of worked but then I ended up in a deletion loop when I reconnected to the server - the app thought I intended to delete all my files so then it started moving everything into the OpenCloud recycle bin and I had to recover them all.

I've read that newer major versions of OpenCloud may have fixed the underlying OIDC problem, but apparently the latest tagged version of the OpenCloud image is still a few major releases behind.