Azure B2C Custom Policy - ID/Access tokens are not getting latest claims through Refresh Token

Question

I've created Azure B2C custom policy to get claims in ID/Access token & getting refresh token through "authorization_code" grant. Then I've updated one of User claim i.e("displayName") through Azure AD Graph API. Next I've tried to get updated claim ("displayName") in ID/Access tokens by using above refresh token against same Azure B2C custom policy through "refresh_grant", However I don't get it.

I've tried "RefreshTokenUserJourneyId" in B2C policy as JWT issuer, but none works.

How should I get latest User claims in ID/Access tokens through refresh token grant once it's updated.

Help required.

Blacken

Hi @Jeeva. What does the refresh token user journey do? Does it read the user object again? – Dorton

Hi Chris, Yes, it reads userobject before calls JwtIssuer. Am I missing something here? – Blacken

Hi @Jeeva. Does it read all of the user properties that you are wanting to re-issue? – Dorton

Hi Chris,Wanted to re-issue "displayName" in token, <OutputClaim ClaimTypeReferenceId="displayName" /> in RP. – Blacken

Hi, I am having the same issue where the latest user claims aren't coming though when using the refresh token journey as above. Did you manage to come up with a solution for this? Thanks. – Symbolic

@Blacken did you find the solution or workaround? i faced the same problem and cannot fix – Nomenclature

Answer 1

I also faced stale claims issue. I was able to get it done using this sample:

https://github.com/azure-ad-b2c/samples/tree/master/policies/refresh-token-journey

You will also face this issue when you want to refresh data in the token from the external identity provider (like Google). This sample also shows how to implement refresh for data from the external IDP:

https://github.com/azure-ad-b2c/samples/blob/master/policies/refresh-token-journey/policy/SignUpOrSignIn_RefreshTokenJourney_WithGoogle.xml

Mattoid