Here’s the complete solution covering all three critical areas for OAuth2 refresh tokens in batch SBOM uploads:
1. OAuth2 Refresh Token Configuration
First, fix your token configuration in site.xconf and OAuth client settings:
<Property name="wt.auth.oauth.refreshTokenLifetime" value="86400"/>
<Property name="wt.auth.oauth.refreshTokenReuseWindow" value="300"/>
<Property name="wt.auth.oauth.allowRefreshTokenRotation" value="true"/>
The refresh token lifetime should be 86400 seconds (24 hours) for batch processes, not 7200. The reuse window of 300 seconds allows for network latency and retry logic. Enable rotation to get new refresh tokens with each refresh.
2. Grant Type and Scope - Critical Change
Your authorization_code grant type is incorrect for batch automation. Update your OAuth client configuration:
// Change from authorization_code to client_credentials
OAuthClient client = new OAuthClient("batch_sbom_client");
client.setGrantType("client_credentials");
client.setScope("Teamcenter.API.Full offline_access");
Client credentials flow doesn’t use refresh tokens the same way - it gets long-lived access tokens directly. However, if you must use authorization_code (for user context), you MUST include “offline_access” scope to get refresh tokens that work beyond session lifetime.
In OAuth Provider admin console: Client Settings > batch_sbom_client > Allowed Scopes > Add “offline_access” and “Teamcenter.SBOM.Write”.
3. Batch Server Connectivity - Token Management
Implement proper token rotation handling in your batch client:
// Pseudocode - Token refresh with rotation:
1. Store both access_token AND refresh_token from initial auth
2. Before each API call, check if access_token expires in <5 minutes
3. If expiring soon, call refresh endpoint with current refresh_token
4. CRITICAL: Store the NEW refresh_token from refresh response
5. Update access_token and continue batch processing
6. Handle 401 errors by immediately refreshing and retrying request
// See OAuth2 spec RFC 6749 Section 6 for refresh flow details
Key points:
- Always use the most recently issued refresh token
- Implement token expiry prediction to refresh proactively
- Add retry logic for 401 errors during the refresh window
- For batch processes over 2 hours, client_credentials is strongly recommended
Additional Configuration:
Verify batch server NTP sync: ntpq -p should show time offset under 1 second. Update your OAuth client in TC:
Go to Organization > Security > OAuth Clients > batch_sbom_client
- Set Token Endpoint Auth Method to “client_secret_post”
- Enable “Allow Refresh Token Rotation”
- Set Access Token Lifetime to 3600 (1 hour)
- Set Refresh Token Lifetime to 86400 (24 hours)
Test with a single SBOM batch job monitoring token refresh in logs before deploying to production batch processing.
This draft is based on general Teamcenter knowledge. It has not been verified against your specific version and environment. Practitioners: verify the steps and share your experience below.