Moving from another Oauth2 server, way to keep access_tokens

[v03adk]

Hello guys!

We are planning to move from "another oauth2 server implementation" to Ory Hydra. We've installed and setup Hydra and our application as Identity Provider, everything is working fine and we're almost happy :) But we have a bunch of clients, that have access_tokens and refresh_tokens, and they just renew access_tokens when they are close to expire, so it would be inconvenient for them to go through auth process again.

So we would like to know if there a way to insert auth data like access_tokens and refresh_tokens to the Hydra MySQL database? I've reveiwed Hydra MySQL scheme and didn't find any plain access_tokens.

[vinckr]

There is probably a way to do it but the safest and best practice would be to go through the auth process again.
I can understand that this might be an inconvenience , but this will ensure sensitive data is protected and also stays in the future.

[v03adk]

Yeah, I completely understand it. But we still stick to a seamless transition. Could you please help us by pointing where to look? Do I understand that under the hood you use Ory/Fosite and its internal memory storage to keep tokens?

[v03adk]

I found this article https://www.ory.sh/hydra/docs/security-architecture/ it's said that tokens are not stored in SQL. so, is there a way to add access_tokens into that another not-sql storage?

[v03adk]

Nevermind, I found out how this key.token thinks works

[vinckr]

Sorry I missed your question.
I think you could ask around in the community on Slack; there are people who have done a "seamless" transition of OAuth2.0 tokens, maybe they can give you some more concrete advice.
The method I read about was basically redirecting users to an endpoint where they get a new token without going through the normal auth flow. This is of course highly dangerous if you dont know what you are doing. You can potentially compromise the whole system. I cant give you more concrete advice than that, but again I must stress that you have to consider the possible implications before doing this.
🐝