title: How to make the refresh token life long valid and issue a new refresh token each time a new refresh_token grant_type comes in spring security oauth2
body: <p>I am using spring security oauth2 for authentication for my android application clients.When the client request comes with grant_type as password the server issues the access token and refresh token.If the access token expires i can issue a new access token by sending a request with grant_type as refresh_token.Now what will i do if my refresh token expires?I dont want to prompt the users to authenticate again using his credentials.So is there a way to issue a new refresh token along with the new access token? or is there any provision to issue a refresh token with infinite validity or by sending a refresh token with single time use only and refresh the refresh token in each refresh_token grant_type request.Below is my configuration file for spring security oauth2.</p>
  
  <pre><code>      &lt;?xml version="1.0" encoding="UTF-8" ?&gt;
    &lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
      xmlns:context="http://www.springframework.org/schema/context"
      xmlns:sec="http://www.springframework.org/schema/security" xmlns:mvc="http://www.springframework.org/schema/mvc"
      xsi:schemaLocation="http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd
        http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.1.xsd
        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.1.xsd
        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.1.xsd "&gt;
  
  
      &lt;!-- This is default url to get a token from OAuth --&gt;
      &lt;http pattern="/oauth/token" create-session="stateless"
        authentication-manager-ref="clientAuthenticationManager"
        xmlns="http://www.springframework.org/schema/security"&gt;
        &lt;intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" /&gt;
        &lt;anonymous enabled="false" /&gt;
        &lt;http-basic entry-point-ref="clientAuthenticationEntryPoint" /&gt;
        &lt;!-- include this only if you need to authenticate clients via request 
          parameters --&gt;
        &lt;custom-filter ref="clientCredentialsTokenEndpointFilter"
          after="BASIC_AUTH_FILTER" /&gt;
        &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
      &lt;/http&gt;
      &lt;!-- This is where we tells spring security what URL should be protected 
        and what roles have access to them --&gt;
      &lt;http pattern="/protected/**" create-session="never"
        entry-point-ref="oauthAuthenticationEntryPoint"
        access-decision-manager-ref="accessDecisionManager"
        xmlns="http://www.springframework.org/schema/security"&gt;
        &lt;anonymous enabled="false" /&gt;
        &lt;intercept-url pattern="/protected/**" access="ROLE_APP" /&gt;
        &lt;custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /&gt;
        &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
      &lt;/http&gt;
  
    &lt;bean id="oauthAuthenticationEntryPoint"
        class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
        &lt;property name="realmName" value="test" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="clientAuthenticationEntryPoint"
        class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
        &lt;property name="realmName" value="test/client" /&gt;
        &lt;property name="typeName" value="Basic" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="oauthAccessDeniedHandler"
        class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" /&gt;
  
      &lt;bean id="clientCredentialsTokenEndpointFilter"
        class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"&gt;
        &lt;property name="authenticationManager" ref="clientAuthenticationManager" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"
        xmlns="http://www.springframework.org/schema/beans"&gt;
        &lt;constructor-arg&gt;
          &lt;list&gt;
            &lt;bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" /&gt;
            &lt;bean class="org.springframework.security.access.vote.RoleVoter" /&gt;
            &lt;bean class="org.springframework.security.access.vote.AuthenticatedVoter" /&gt;
          &lt;/list&gt;
        &lt;/constructor-arg&gt;
      &lt;/bean&gt;
  
      &lt;authentication-manager id="clientAuthenticationManager"
        xmlns="http://www.springframework.org/schema/security"&gt;
        &lt;authentication-provider user-service-ref="clientDetailsUserService" /&gt;
      &lt;/authentication-manager&gt;
      &lt;authentication-manager alias="authenticationManager"
        xmlns="http://www.springframework.org/schema/security"&gt;
        &lt;authentication-provider  user-service-ref="userService"&gt;
        &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  
      &lt;bean id="userService"
        class="com.example.myproject.ser.UserService"&gt;
      &lt;/bean&gt;
  
      &lt;bean id="clientDetailsUserService"
        class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"&gt;
        &lt;constructor-arg ref="clientDetails" /&gt;
      &lt;/bean&gt;
  
  
      &lt;!-- This defined token store, we have used inmemory tokenstore for now 
        but this can be changed to a user defined one --&gt;
      &lt;bean id="tokenStore"
        class="org.springframework.security.oauth2.provider.token.InMemoryTokenStore" /&gt;
  
      &lt;!-- This is where we defined token based configurations, token validity 
        and other things --&gt;
      &lt;bean id="tokenServices"
        class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"&gt;
        &lt;property name="tokenStore" ref="tokenStore" /&gt;
        &lt;property name="supportRefreshToken" value="true" /&gt;
        &lt;property name="accessTokenValiditySeconds" value="120" /&gt;  &lt;!-- 2 hour 3600 --&gt;
        &lt;property name="refreshTokenValiditySeconds" value="420"&gt;&lt;/property&gt;   &lt;!-- 2 month 5270400 --&gt;
        &lt;property name="clientDetailsService" ref="clientDetails" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="userApprovalHandler"
        class="org.springframework.security.oauth2.provider.approval.TokenServicesUserApprovalHandler"&gt;
        &lt;property name="tokenServices" ref="tokenServices" /&gt;
      &lt;/bean&gt;
      &lt;oauth:authorization-server
        client-details-service-ref="clientDetails" token-services-ref="tokenServices"
        user-approval-handler-ref="userApprovalHandler"&gt;
        &lt;oauth:authorization-code /&gt;
        &lt;oauth:implicit /&gt;
        &lt;oauth:refresh-token /&gt;
        &lt;oauth:client-credentials /&gt;
        &lt;oauth:password /&gt;
      &lt;/oauth:authorization-server&gt;
  
      &lt;oauth:resource-server id="resourceServerFilter"
        resource-id="test" token-services-ref="tokenServices" /&gt;
  
  
  
     &lt;bean id="clientDetails"
              class="com.example.myproject.ser.ClientService"&gt;
        &lt;/bean&gt; 
  
  
  
      &lt;sec:global-method-security
        pre-post-annotations="enabled" proxy-target-class="true"&gt;
        &lt;!--you could also wire in the expression handler up at the layer of the 
          http filters. See https://jira.springsource.org/browse/SEC-1452 --&gt;
        &lt;sec:expression-handler ref="oauthExpressionHandler" /&gt;
      &lt;/sec:global-method-security&gt;
  
      &lt;oauth:expression-handler id="oauthExpressionHandler" /&gt;
      &lt;oauth:web-expression-handler id="oauthWebExpressionHandler" /&gt;
    &lt;/beans&gt;
  </code></pre>
  
  <p>In my android application i have the provision to authenticate the same user from multiple devices.That is one can authenticate in any device if already he is authenticated in other device.So the solution don't affect this case.</p>