Problems as of June 12, 2023 with One Exact Identity
Exact recently activated One Exact Identity without prior nnouncement for a limited portion of users. Affected users will be given the option to switch to this different authentication model. For a subset of users, this will become a mandatory transition on June 16, 2023.
In combination of Exact Online with One Exact Identity, there are currently (June 12, 2023) two known problems in combination with recent releases such as 22.0.660:
- when going through the login process on Get My Report and Currency Tools, one frequently does not end up in the application, but in Exact Online itself, or an “Oops” page appears with the URL
SysError404.aspx?aspxerrorpath=/signin-azureb2c. - when using Invantive Data Hub, the application cannot log on to the Exact Online data container(s).
On releases before 22.0.660, logging in via the Windows products (such as Invantive Control for Excel and Invantive Query Tool) is not possible via the Microsoft Edge browser displayed “embedded” within the application. These issues have been resolved by switching to a recent release; all active users have received a request by email to upgrade their installation.
On other Exact platforms such as Bouw7, Fiscaal Gemak or Gripp, there are no known issues with One Exact Identity, but those platforms also tend to be significantly simpler in terms of API usage.
Currency Tools and Get My Report
Frequently, the wrong screen is displayed after going through the login process: Exact Online itself appears instead of the requested web application. This problem probably occurs with all apps on Exact Online, but Get My Report and Currency Tools have a special feature: they do not retain login data for security reasons. Therefore, it is often necessary to log in again.
Workaround for this problem is to navigate again to the home page of the application in the browser and log in again. As far as we know, repeated attempts always succeed.
Data Hub
There are two different product variants in circulation called “Invantive Data Hub”:
- Invantive Data Hub: only for use with the .net Framework v4.8 on Microsoft Windows.
- Invantive Data Hub Multi-platform: for use on Windows, Linux and MacOS with .net core v6.0.
The Windows variant of Invantive Data Hub is the most widely used for historical reasons. In no releases, including release 22.0.660, the Windows variant is compatible with One Exact Identity.
The multi-platform variant of Invantive Data Hub is compatible with One Exact Identity as of release 22.0.660.
Compatibility between .net framework variant of Data Hub and One Exact Identity is not expected in future releases; please upgrade to the multi-platform version where possible as instructed at the end of this article.
Why doesn’t Data Hub work?
Invantive Data Hub is a command-line-based variant of Invantive SQL that should also be able to work over a telnet connection. The Exact Online authorization flows as well as the current One Exact Identity do not support telnet-based authentications by default and, as far as we know, there are no initiatives by Exact to improve this. The Exact Online authorization flow assumes all applications run within the same browser where both authorization and usage take place.
Invantive Data Hub has a three-step process when logging into Exact Online:
- try to use the last known access token of an Exact Online user from Invantive Keychain,
- if access token does not work: try to use the last known refresh token of an Exact Online user to acquire a new access token,
- if refresh token is not working: go through the Implicit Grant Flow to acquire an access token if no client secret is specified, and otherwise go through the Code Grant Flow to acquire both access token and refresh token.
An access token can be used for up to 10 minutes after acquisition to establish and maintain a connection. A refresh token can be acquired at a maximum rate of once every 9.5 minutes. A refresh token expires after 30 days and must be renewed every 10 minutes when in use. A refresh token will expire if another refresh token is acquired and used within the same environment or elsewhere for the same combination of Exact Online user and client ID.
In response to the risks of late or unannounced changes by Exact, the agreements were also updated some years ago: Change conditions Invantive Data Hub and Invantive Data Replicator.
More general information on the limitations and handling of the Exact Online authorization model since 2021 can be read at Impact Exact Online API adjustments July 1, 2021.
Data Hub workaround via Query Tool
A temporarily acceptable replacement for Invantive Data Hub is to manually start the jobs via Invantive Query Tool in the same software version (for example, “22.0.660”). Invantive Query Tool and Invantive Data Hub are fully compatible in terms of scripts and operation. Invantive Query Tool and Invantive Data Hub contain the same drivers if the same versions are used.
Data Hub workaround via Multi-platform
A possible workaround is to replace the Windows variant of Invantive Data Hub with the multi-platform variant. The multi-platform variant is almost entirely compatible in terms of scripts and operation with the Windows variant. To switch to the multi-platform variant, follow the steps described in: