Recurrent TokenError: Bad Request (invalid_grant) from Node service

[hide-afk]

Description

Hello,

Every few days my MeshCentral server throws the following error repeatedly:

TokenError {
name: 'TokenError',
message: 'Bad Request',
code: 'invalid_grant',
uri: undefined,
status: 500
}

This seems to originate from the Node service. After some investigation, it may be related to the Google SSO (OAuth) authentication integration.

---

Expected Behavior

Tokens should refresh correctly without triggering invalid_grant errors.

---

Environment

• OS: Ubuntu Server 24.04 LTS
• MeshCentral version: 1.1.53
• Node.js version: 22.17.1

---

Additional Context

The error seems to occur periodically.

[si458]

what does your config.json look like? (https://melo-professional.github.io/MeshCentral-config-sanitizer/)

[hide-afk]

{
  "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
  "settings": {
    "MongoDb": "mongodb://127.0.0.1:27017/meshcentral",
    "WANonly": true,
    "port": 443,
    "redirPort": 80,
    "cert": "X.dev",
    "sessionKey": "-",
    "log": [
      "cookie",
      "main",
      "peer",
      "agent",
      "agentupdate",
      "cert",
      "db",
      "email",
      "web",
      "webrequest",
      "relay",
      "httpheaders",
      "authlog",
      "amt",
      "webrelay",
      "mps",
      "mpscmd",
      "webrelaydata",
      "swarm",
      "swarmcmd",
      "websocket"
    ],
    "meshErrorLogPath": "/opt/meshcentral/meshcentral-data/meshcentral-logs/meshErrorlog.txt",
    "maxInvalidLogin": {
      "time": 15,
      "count": 4,
      "coolofftime": 15
    },
    "agentPong": 30
  },
  "domains": {
    "": {
      "NewAccounts": false,
      "showModernUIToggle": true,
      "authStrategies": {
        "google": {
          "callbackurl": "https://X/auth-google-callback",
          "clientid": "-.apps.googleusercontent.com",
          "clientsecret": "-"
        }
      }
    }
  },
  "smtp": {
    "host": "smtp.gmail.com",
    "port": 587,
    "from": "[email protected]",
    "user": "[email protected]",
    "pass": "-",
    "tls": false
  },
  "letsencrypt": {
    "email": "[email protected]",
    "names": "X",
    "production": true
  }
}

[hide-afk]

Hi @si458 , after some research, I think it's related to the Google Authentication failing doing some requests:

[si458]

one thing to try is switching to oidc https://ylianst.github.io/MeshCentral/meshcentral/openidConnectStrategy/#google-preset
as using google for the authStrategies uses a different npm module passport-google-oauth20
but the main one every uses is oidc which uses openid-client

[hide-afk]

I see. Do I have to get any new ids or keys? Or I just implement it like this:

"authStrategies": {
		"oidc": {
		    "client": {
		        "client_id": "myOldId.apps.googleusercontent.com",
		        "client_secret": "myOldClientSecret"
		    }
		}
	}