pomerium / pomerium/datasource
azure directory timeouts
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 4
- Forks
- 1
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 7
Description
What happened?
Occasionally when doing large sync calls with the Azure Microsoft Graph Delta API we are seeing timeouts:
{
"level":"debug",
"method":"GET",
"authority":"[graph.microsoft.com](http://graph.microsoft.com/)",
"path":"/v1.0/groups/delta",
"duration":686.488539,
"response-code":401,
"idp":"azure",
"response-body":"{\"error\":{\"code\":\"InvalidAuthenticationToken\",\"message\":\"Access token has expired or is not yet valid.\",\"innerError\":{\""
}
What did you expect to happen?
For large directory syncs to succeed.
Additional context
We should investigate a few different ideas here:
- Why are the access tokens not refreshing as we expect? Each API call (even for thousands of delta API calls) should check if the token is valid before re-using it. Are we hitting an issue where the token is valid only for a few seconds before it expires, so we-reuse it, but then it fails?
- Perhaps we should implement a simple retry mechanism to force a refresh of the access token when this error occurs and retry the API call
- Is there something in the delta API we can use to resume where we left off? Maybe
$skiptoken? - Can we increase the access token expiration timestamp somehow?
Locally we should be able to reproduce the behavior by adding an artifical lag to all requests. The default access token expiration is between 60 and 90 minutes.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing large Azure Microsoft Graph Delta API syncs with artificial request lag, then inspect how access tokens are checked and refreshed for each request. Compare the timeout response with the proposed retry and delta-resume ideas; done means the cause is identified and a reliable approach for completing large directory syncs is defined.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, go
- Domain
- api, authentication, backend, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100