title: Preventing login requests using OAuth2 with the same user but multiple devices
body: <p>We're using Grails and the OAuth2 plugin, but this is a more general OAuth2 question.  </p>
  
  <p>We're trying to work out an issue where the same user is using multiple devices and we don't want to prompt for their user/password if it's not necessary. Take the following for example:</p>
  
  <ul>
  <li>AT = Access Token </li>
  <li>RT = Refresh Token </li>
  </ul>
  
  <p>(Assume initial ATs can be obtained using the password grant type and both devices get the same AT)</p>
  
  <pre><code>Device 1:
  1. Refresh, new AT
  5. Bad AT
  6. Refresh denied (bad RT)
  7. Need Password for AT, new RT ... Repeats every time it expires
  
  Device 2:
  2. Bad AT 
  3. Refresh denied (bad RT)
  4. Need Password for new AT/RT
  </code></pre>
  
  <p>We obviously don't want to cache the password, and shouldn't need to prompt the user when we have a refresh token.  There is a flag to reuse the refresh token, but if we did, we'd end up generating new access tokens, for example:</p>
  
  <pre><code>Device 1:
  1. Refresh, new AT
  4. Bad AT
  5. Refresh, new AT… Repeats every request
  
  Device 2:
  2. Bad AT
  3. Refresh, new AT
  </code></pre>
  
  <p>I assume we're not the first to encounter this type of problem, so I thought I'd reach out for thoughts/suggestions.</p>