OAuth Refresh Token Job

Setup a scheduled job to ensure refresh tokens do not expire.

We recommend customers using outbound OAuth use this scheduled job script to ensure outbound OAuth connections remain alive, as explained in this KB Article from ServiceNow.

Without this job, the refresh token will eventually expire which means ServiceNow will no longer be able to retrieve an access token. This in turn will cause outbound requests to fail.

If your OAuth service is including refresh tokens with each access token request, this job may not be required.

This script has been reformatted from the KB Article for ease of use.

function refreshAccessToken(requestorId, oauthProfileId, token) {
    if (!(token && requestorId && oauthProfileId)) return;

    var tokenRequest = new sn_auth.GlideOAuthClientRequest();
    tokenRequest.setGrantType("refresh_token");
    tokenRequest.setRefreshToken(token.getRefreshToken());
    tokenRequest.setParameter('oauth_requestor_context','sys_rest_message');
    tokenRequest.setParameter('oauth_requestor', requestorId);
    tokenRequest.setParameter('oauth_provider_profile',oauthProfileId);

    var oAuthClient = new  sn_auth.GlideOAuthClient();
    var tokenResponse = oAuthClient.requestTokenByRequest(null,tokenRequest);
    var error = tokenResponse.getErrorMessage();
    if (error) gs.warn("Error:" + tokenResponse.getErrorMessage());
}

function isExpired(expiresIn, withinSeconds) {
    if (expiresIn > withinSeconds) return false;
    return true;
}


function getToken(requestorId, oauthProfileId) {
    if (!requestorId || !oauthProfileId) return null;
    var client = new sn_auth.GlideOAuthClient();
    return client.getToken(requestorId, oauthProfileId);
}

function checkAndRefreshAccessToken(grRestMessage) {
    if (grRestMessage.getValue("authentication_type") != "oauth2") return false;
    var accountMsg = grRestMessage.getValue("name");
    if (!accountMsg)
        accountMsg = grRestMessage.getUniqueValue();
    accountMsg = "Account=\"" + accountMsg + "\"";

    var token = getToken(grRestMessage.getUniqueValue(), grRestMessage.getValue('oauth2_profile'));
    var accessToken = token.getAccessToken();

    if (accessToken) {
        if (!isExpired(token.getExpiresIn(), 300)) return;
    }

    if (!token.getRefreshToken()) {
        gs.error("No OAuth refresh token for Rest Message. Manual reauthorization required. " + accountMsg);
        return;
    }

    if (isExpired(token.getRefreshTokenExpiresIn(), 0)) {
        gs.error("OAuth refresh token for Rest Message is expired. Manual reauthorization required. " + accountMsg);
        return;
    }

    gs.info("Refreshing oauth access token for Rest Message account. " + accountMsg);
    refreshAccessToken(grRestMessage.getUniqueValue(), grRestMessage.getValue('oauth2_profile'), token);
}

var grAccount = new GlideRecord("sys_rest_message");
grAccount.addQuery("authentication_type", "oauth2");
grAccount.addNotNullQuery("oauth2_profile");
grAccount.query();

while (grAccount.next()) {
    checkAndRefreshAccessToken(grAccount);
}