Let me provide a comprehensive solution addressing all three key areas: OAuth refresh token scope, session timeout settings, and mobile app token storage.
OAuth Refresh Token Scope Configuration:
Navigate to your Connected App settings and verify the OAuth scopes include both ‘refresh_token’ and ‘offline_access’. The offline_access scope is critical for mobile apps to maintain authentication across app restarts and device sleep cycles.
Refresh Token Policy Fix:
Your current 1-day expiration is causing the constant logouts. Here’s the recommended configuration:
Setup > Connected Apps > Your Mobile App
OAuth Policies > Refresh Token Policy:
- Set to "Refresh token valid for 90 days"
- Enable "Rotate refresh token on use"
This gives mobile users sufficient validity while maintaining security through token rotation.
Session Timeout Alignment:
Go to Setup > Session Settings and configure:
- Session timeout: 4 hours (longer than current 2 hours for field work)
- Disable timeout warning: Unchecked (gives users warning before expiration)
- Force logout on session timeout: Unchecked for mobile profiles
For mobile-specific profiles, create a custom session setting that’s more lenient than desktop users.
Mobile App Token Storage:
If you’re using Salesforce Mobile SDK, the token storage should be handled automatically via platform-specific secure storage (iOS Keychain/Android Keystore). However, verify these implementation points:
- Token Refresh Logic: Ensure your app implements proactive token refresh before expiration:
// Check token expiry 5 minutes before actual expiry
if (tokenExpiryTime - currentTime < 300000) {
refreshOAuthToken();
}
-
Background Refresh: Enable background token refresh in your mobile app configuration to handle refreshes even when app is backgrounded.
-
Error Handling: Implement proper retry logic for failed refresh attempts with exponential backoff.
IP Restriction Configuration:
For mobile users, you have two options:
- Option A: Disable IP restrictions entirely for the mobile Connected App
- Option B: Implement “Relax IP restrictions” for mobile user profiles (Setup > Profiles > Session Settings)
I recommend Option B as it provides better security while accommodating mobile users.
Verification Steps:
- Update Connected App refresh token policy to 90 days
- Add ‘offline_access’ to OAuth scopes if missing
- Extend session timeout to 4 hours for mobile profiles
- Enable IP relaxation for field sales profiles
- Test with a pilot group of field users for 48 hours
- Monitor OAuth token refresh events in Event Monitoring
Monitoring and Validation:
Enable Event Monitoring for OAuth tokens and watch for these events:
- LoginAs events (indicates forced re-authentication)
- OAuth Token Refresh events (should show successful refreshes)
- Session hijacking events (validates security isn’t compromised)
After implementing these changes, your mobile users should maintain persistent authentication throughout their workday without forced logouts. The combination of extended refresh token validity, proper scope configuration, and relaxed IP restrictions for mobile profiles will resolve the field sales disruption while maintaining reasonable security controls.
This draft is based on general Salesforce knowledge. It has not been verified against your specific version and environment. Practitioners: verify the steps and share your experience below.