OAuth 2.0 - Not getting refresh token

Question

OAuth 2.0 - Not getting refresh token

Himanshu Joshi 0

Hello,

I am using OAuth 2.0 for authorization and using msal-node package I successfully got an access token in response but did not get a refresh token I am using User.Read scope to get access token

Nivedipa-MSFT 3,946 Reputation points Microsoft External Staff Moderator

2024-11-26T06:26:27.24+00:00

@Himanshu Joshi - To obtain a refresh token, you need to include the offline_access scope in your authorisation request. This scope is specifically designed to request a refresh token, which allows your application to maintain access to resources without requiring the user to re-authenticate

Ref Doc: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow#refreshing-the-access-tokens

Thanks,

Nivedipa

*************************************************************************

You can share your feedback via Microsoft Teams Developer Feedback link. Click hereto escalate.

Himanshu Joshi 0

 const tokenRequest = {
        code: req.query.code,
        scopes: ["User.Read", "offline_access", "openid"],
        redirectUri: REDIRECT_URI,
      };
      pca.acquireTokenByCode(tokenRequest).then(async (response) => {
        console.log('response: ', response);

I passed the above scopes but still not get refresh token

I am getting the below scopes in response

scopes: [
    'Calendars.Read',
    'Calendars.Read.Shared',
    'Calendars.ReadBasic',
    'Calendars.ReadWrite',
    'Calendars.ReadWrite.Shared',
    'CallEvents.Read',
    'Directory.AccessAsUser.All',
    'Directory.Read.All',
    'Directory.ReadWrite.All',
    'Files.Read',
    'Files.Read.All',
    'Files.Read.Selected',
    'Files.ReadWrite',
    'Files.ReadWrite.All',
    'Files.ReadWrite.AppFolder',
    'Files.ReadWrite.Selected',
    'Files.SelectedOperations.Selected',
    'Group.Read.All',
    'Group.ReadWrite.All',
    'OnlineMeetingAiInsight.Read.All',
    'OnlineMeetingArtifact.Read.All',
    'OnlineMeetingRecording.Read.All',
    'OnlineMeetings.Read',
    'OnlineMeetings.ReadWrite',
    'OnlineMeetingTranscript.Read.All',
    'openid',
    'profile',
    'Sites.FullControl.All',
    'Sites.Manage.All',
    'Sites.Read.All',
    'Sites.ReadWrite.All',
    'Sites.Selected',
    'Team.Create',
    'Team.ReadBasic.All',
    'User.DeleteRestore.All',
    'User.EnableDisableAccount.All',
    'User.Export.All',
    'User.Invite.All',
    'User.ManageIdentities.All',
    'User.Read',
    'User.Read.All',
    'User.ReadBasic.All',
    'User.ReadWrite',
    'User.ReadWrite.All',
    'User.RevokeSessions.All',
   'email'
  ],

Nivedipa-MSFT 3,946 Reputation points Microsoft External Staff Moderator

2024-12-05T08:55:31.1033333+00:00

@Himanshu Joshi - Ensure that your application is registered correctly in the Azure portal and that it has the necessary API permissions. Specifically, verify that the offline_access permission is granted.
Sometimes, even if the scopes are included, the permissions might not be granted until an admin consents to them. Make sure that admin consent has been granted for the required permissions.

1 answer

Your answer

Nivedipa-MSFT 3,946 Reputation points Microsoft External Staff Moderator

2024-11-26T06:26:27.24+00:00

@Himanshu Joshi - To obtain a refresh token, you need to include the offline_access scope in your authorisation request. This scope is specifically designed to request a refresh token, which allows your application to maintain access to resources without requiring the user to re-authenticate

Ref Doc: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow#refreshing-the-access-tokens

Thanks,

Nivedipa

*************************************************************************

You can share your feedback via Microsoft Teams Developer Feedback link. Click hereto escalate.
Himanshu Joshi 0 Reputation points

2024-11-27T11:00:30.1533333+00:00

const tokenRequest = { code: req.query.code, scopes: ["User.Read", "offline_access", "openid"], redirectUri: REDIRECT_URI, }; pca.acquireTokenByCode(tokenRequest).then(async (response) => { console.log('response: ', response);

I passed the above scopes but still not get refresh token

I am getting the below scopes in response

scopes: [ 'Calendars.Read', 'Calendars.Read.Shared', 'Calendars.ReadBasic', 'Calendars.ReadWrite', 'Calendars.ReadWrite.Shared', 'CallEvents.Read', 'Directory.AccessAsUser.All', 'Directory.Read.All', 'Directory.ReadWrite.All', 'Files.Read', 'Files.Read.All', 'Files.Read.Selected', 'Files.ReadWrite', 'Files.ReadWrite.All', 'Files.ReadWrite.AppFolder', 'Files.ReadWrite.Selected', 'Files.SelectedOperations.Selected', 'Group.Read.All', 'Group.ReadWrite.All', 'OnlineMeetingAiInsight.Read.All', 'OnlineMeetingArtifact.Read.All', 'OnlineMeetingRecording.Read.All', 'OnlineMeetings.Read', 'OnlineMeetings.ReadWrite', 'OnlineMeetingTranscript.Read.All', 'openid', 'profile', 'Sites.FullControl.All', 'Sites.Manage.All', 'Sites.Read.All', 'Sites.ReadWrite.All', 'Sites.Selected', 'Team.Create', 'Team.ReadBasic.All', 'User.DeleteRestore.All', 'User.EnableDisableAccount.All', 'User.Export.All', 'User.Invite.All', 'User.ManageIdentities.All', 'User.Read', 'User.Read.All', 'User.ReadBasic.All', 'User.ReadWrite', 'User.ReadWrite.All', 'User.RevokeSessions.All', 'email' ],
Nivedipa-MSFT 3,946 Reputation points Microsoft External Staff Moderator

2024-12-05T08:55:31.1033333+00:00

@Himanshu Joshi - Ensure that your application is registered correctly in the Azure portal and that it has the necessary API permissions. Specifically, verify that the offline_access permission is granted.
Sometimes, even if the scopes are included, the permissions might not be granted until an admin consents to them. Make sure that admin consent has been granted for the required permissions.

Answer 1

To obtain a refresh token, you need to include the offline_access scope in your authorisation request. This scope is specifically designed to request a refresh token, which allows your application to maintain access to resources without requiring the user to re-authenticate User's image

Ref Doc: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow#refreshing-the-access-tokens

Thanks,

Nivedipa

*************************************************************************

You can share your feedback via Microsoft Teams Developer Feedback link. Click hereto escalate.

Share via

OAuth 2.0 - Not getting refresh token

1 answer

Your answer