[Alpine-info] invalid_grant error AADSTS70043: expired or invalid refresh token

[Eduardo Chappa]

On Tue, 18 Jul 2023, Brad Chamberlain wrote:


> Thanks for the tips!  I guess I didn't say in my original message, but 

> when the failure originally occurred (upon running 'alpine'), the reason 

> for the failure was completely unclear.  It just said something vague 

> like "unable to open INBOX" or the like.


Dear Brad,

   my memory is not the best, nor do I have direct experience with Macs, so 
I till tell you what I remember from my Linux experience. First, depending 
on the version of Alpine that you are using, the error that prevented you 
from opening the inbox might not be fully displayed, but the latest 
version of Alpine will. The error you displayed is consistent with using 
version 2.26, so you are up to date in that side.


> I kept hoping that I'd eventually get the device login prompt and web

> redirect if I waited long enough or restarted enough times or tried

> reopening it enough times, but I never did.  It was only when re-running

> with the '-erase_stored_passwords' flag that I was offered the chance to

> do a new device login / get a new token from Outlook.


My experience is that you do not need to restart Alpine. My thinking is 
that (in Linux, and Windows, but probably not in Mac OS) when the access 
token created by the refresh token fails fails, the refresh token is 
erased, so the next time the process is attempted it starts from scratch.

I will have to double check that this is the case.


> If I were to get into this situation again, are there other ways to 

> force getting a new refresh token other than using that flag, or did I 

> end up finding the best practice?


using the erase-passwords option seems to be the correct way to solve this 
issue, albeit it erases all your passwords. If the problem happened every 
time that you opened alpine, then it means that the alpine version is not 
deleting that credential, and I need to look into that.

All of this would be much easier if Mac and Windows did not have their own 
way to deal with password support. I am thinking of doing one of two 
things: either forcing everyone to use password file support or adding a 
password file into the windows credentials and the mac keychain. This 
would make it much simpler to support alpine across several platforms.
I know I upset people when I do this kind of things, so if anyone has 
opinions that I should consider, I will be happy to read them.

-- 
Eduardo