-
Title
REST API returns "Your session has expired" (57002006) when authenticating with an OAuth/OIDC Bearer token -
Description
OAuth 2.0/OpenID Connect login to the Web Portal UI works correctly.
Calling the API Server REST API directly with Authorization Bearer
[ { "Message": "Your session has expired. Reload this page and log in again.", "Number": 57002006 } ]
The API Server log file contains: "Authentication token found, but no token authentication configured."
-
Cause
That log lineconfirms the API Server received and read the Bearer token correctly but token based authentication is not turned on on, so the token is discarded and the request is treated as unauthenticated.
In versions 9.2.x and 9.3.x, the API Server accepts access tokens for the REST API only when the configuration parameter "QBM\AppServer\AccessTokenAuth" is enabled. This setting is disabled by default.
Interactive Web Portal OAuth login uses a different (browser-redirect) code path that does not depend on this parameter, which is why portal login succeeds while direct Bearer API calls fail.
Note: despite "AppServer" in the name, this parameter governs both the Application Server and the API Server in 9.2.x or 9.3.x.
-
Resolution
1. In the Designer, go to Base data - General - Configuration parameters.
2. Enable QBM\AppServer\AccessTokenAuth.
3. If you authenticate with the role-based OAuth module ("OAuth 2.0/OpenID Connect (role-based)"), also enable QBM\AppServer\AccessTokenAuth\RoleBased.
4. Restart the API Server or recycle its IIS application pool so the new configuration is loaded.
5. Retest.
Prerequisites (already in place if interactive OAuth login works):
An OAuth 2.0/OpenID Connect authentication module is configured and enabled.