Get refresh token with Azure AD V2.0 (MSAL) and Asp .Net Core 2.0

Question

I've got access_token from Azure Ad V2.0 endpoint to call Graph Api. But I have to do some actions in the api on behalf of user. So I need refresh_token to renew my access_token when it'll expire.

Is there any way to get Refresh token using MSAL in ASP .Net Core?

In microsoft documentaion they're telling it's possible to do by requesting /token endpoint. But I couldn't find how to do it using MSAL.

Asclepius

MSAL usually handles the refresh token for you. You would need to implement the token cache properly for your app. – Alpaca

Is there any way to get it? I'll keep it in a database or Azure KeyVault – Asclepius

I think there is no API to get them. The way to implement what you want would be to make a token cache class which handles storing the data (and loading it) in Key Vault for example. – Alpaca

Though you should also add some in-memory caching in that case.. You don't want to hit Key Vault every single time. – Alpaca

You can look through the MSAL source if you want :) github.com/AzureAD/microsoft-authentication-library-for-dotnet – Alpaca

Answer 1

MSAL .NET does not expose the refresh token, but rather keeps it internal and handles all token refresh and caching logic on the app's behalf.

The docs you're referring to are referencing the protocol itself that MSAL is completing on your behalf. It goes to the /token endpoint with an authorization code (after the end user signs in), and is issued an Access and Refresh token. The Access Token is valid for 1 hour, and when it's expired, AcquireTokenSilent will automatically use the refresh token against the /token endpoint to get a new access token.

Shuster

Thanks for the answer. I am using microservices architecture, so my back and front services are apart. The problem is to get access token from front service (js) and send it to .net core web api (back). Back service will call graph api and do some other things using this token. So I need to have refresh token in my back-end service to be able to manage tokens. – Asclepius

@S.Anna Have you taken a look at the on-behalf-of flow? I think it would be perfect for this scenario. Basically, your client app will get a token and send it to your backend (just like before). Then, the backend can send this token to Azure AD for a new token that can be used for a downstream API like the Microsoft graph. – Shuster

I've looked through the documentation. Now I want to implement on-behalf-of-flow scenario using MSAL and can't find any documentation. Can you help with any kind of example how to do it? – Asclepius

We don't have a code sample on the on-behalf-of flow yet, but here's the reference docs on the protocol which should get you on the right path. – Shuster

whilst this answer is correct when accessing pages, if youre on the same page and make an ajax request, this is not the case. – Gilstrap

My IDTokens are 1hr expiry, RefreshTokens 8hr... when the 8hrs is up, MSAL gives up just throws an exception when trying to get a new IDToken. Shouldn't it also manage the RefreshTokens by getting a new one when required? – Bile

Answer 2

I got a bit topsy-turvy on this, as well. Explaining a bit more based on my understanding.

• For context, OAuth 2.0 code grant flow mentions the following steps:
  • authorization, which returns auth_code
  • using auth_code, to fetch access_token (usually valid for 1 hr) and refresh_token
  • access_token is used to gain access to relevant resources
  • after access_token expires, refresh_token is used to get new access_token
• MSAL.NET abstracts this concept of refresh_token via TokenCache.
  • There is an option to serialize TokenCache. See Token cache serialization in MSAL.NET. This is how to preserve sign-in info b/w desktop application sessions, and avoid those sign-in windows.
  • AcquireTokenSilentAsync is the process by which refresh_token is used to get new access_token, but, this is internally done. See AcquireTokenSilentAsync using a cached token for more details and other access patterns.

Hope this clarifies on why TokenCache is the 'new' refresh_token in MSAL.NET, and TokenCache is what you would need to serialize and save. There are libraries like Microsoft.Identity.Client.Extensions.Msal that aid in this.

Fussbudget

Answer 3

TokenCache is basically a JSON object which is served as byte array when you call SerializeMsalV3(). When you convert byte array to string, you will see both access token and refresh token. Then you can make a HTTP request to \token endpoint with this refresh token and grant_type: "refresh_token" body parameters.

IConfidentialClientApplication capp =
                    ConfidentialClientApplicationBuilder.Create(myClientId)
                        .WithClientSecret(myclientSecret)
                        .Build();

    capp.UserTokenCache.SetAfterAccess((TokenCacheNotificationArgs args) =>
    {
       exchangeTokenCacheV3Bytes = args.TokenCache.SerializeMsalV3();
       string jsonString = System.Text.Encoding.UTF8.GetString(exchangeTokenCacheV3Bytes);
    });

Fields