Invalid_grant error while trying to request a token using refresh_token

Question

Hello there, I am using b2c login. I am able to get access_token, first requesting a code via the authorize and then using the code in /token endpoint. The issue is that I get
{"error":"invalid_grant","error_description":"AADB2C90085: The service has encountered an internal error. Please reauthenticate and try again.\r\nCorrelation ID: 9034811c-6025-4e86-947d-fa6911c2c2c4\r\nTimestamp: 2020-12-10 01:30:47Z\r\n"}
Any idea what might be the issue? I have supplied all the necessary parameters like policy, client_id, client_secret, grand_type (which is refresh_token), refresh_token and scope. I tried to find the details about the issue using the correlation ID, but I don't get any record when I run Get-AzureRmLog -CorrelationId "9034811c-6025-4e86-947d-fa6911c2c2c4"

Answer 1

Hi Amar-6172 · Welcome to Q&A platform and thanks for your query.

In your Base file, please define ClaimType ID refreshTokenIssuedOnDateTime and add it to TpEngine_RefreshToken as shown below:

      <ClaimType Id="refreshTokenIssuedOnDateTime">  
        <DisplayName>Refresh Token Issued On Date Time</DisplayName>  
        <DataType>string</DataType>  
      </ClaimType>          
		  
		<TechnicalProfile Id="TpEngine_RefreshToken">  
          <DisplayName>Trust Framework Policy Engine Token Refresh</DisplayName>  
          <Protocol Name="None" />  
          <OutputClaims>  
            <OutputClaim ClaimTypeReferenceId="objectId" />  
            <OutputClaim ClaimTypeReferenceId="refreshTokenIssuedOnDateTime" />  
          </OutputClaims>  
        </TechnicalProfile>  

Please refer to this base file for more details and look for refreshTokensValidFromDateTime in this file as well.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

May I reopen this issue? @AmanpreetSingh-MSFT
I updated my policies according to release notes from 09 August 2022 (starter pack).

I'm able to get all tokens via auth code flow. But using the refresh token (grant_type refresh_token) in ends up with AADB2C90085.

1. Is there a way to debug this?
2. What is the difference in using relyingParty->endpoint id=token VS TechnicalProfile JwtIssuer metadata RefreshTokenUserJourneyId ?