Mismatch in Azure B2C Token Expiry with Configured Session Lifetime in API Management

Question

Mismatch in Azure B2C Token Expiry with Configured Session Lifetime in API Management

hawthorne91 240

I have B2C integrated with my Azure API Management service for authorization. I've been trying to adjust the session behavior in my user flow, setting the Web app session lifetime (minutes) to 15 minutes. In the token lifetime, I've also set the Access & ID token lifetimes (minutes) to 15. However, when I inspect the page and look at the token's headers, I see that the Set-Cookie header for the token states that it's going to expire in a hour. Why is this issue arising?

I've done some research into the issue, and found this post about this issue: https://stackoverflow.com/questions/58835708/changing-azure-ad-b2c-access-token-lifetime-doesnt-work They are encountering the same issue as me, however it hasn't been updated - I was wondering if this issue may have already been fixed as it was an issue back in 2019.

Akhilesh Vallamkonda 15,340 Reputation points Moderator

2025-01-23T18:35:51.85+00:00

Hello @hawthorne91

I am checking this and will get back to you with further inputs.

Thanks,

Akhilesh.
hawthorne91 240 Reputation points

2025-01-23T18:44:35.7733333+00:00

Hi Akhilesh Vallamkonda,

Thank you for checking, I look forward to your response!

1 answer

Your answer

Akhilesh Vallamkonda 15,340 Reputation points Moderator

2025-01-23T18:35:51.85+00:00

Hello @hawthorne91

I am checking this and will get back to you with further inputs.

Thanks,

Akhilesh.
hawthorne91 240 Reputation points

2025-01-23T18:44:35.7733333+00:00

Hi Akhilesh Vallamkonda,

Thank you for checking, I look forward to your response!

Answer 1

Akhilesh Vallamkonda 15,340 Moderator

Hi @hawthorne91

Sorry for the delay in response.

I have tested your scenario, and I have seen the token lifetime is same as configured in Azure AD B2C User's image

Could you please check by try to Configure token lifetime and Request an access token and decode the token by using https://jwt.ms and check the token exp to know the expiration and is it is same as configured.

Hope this helps. Do let us know if you any further queries by responding in the comments section.

Thanks,

Akhilesh.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

hawthorne91 240 Reputation points

2025-01-28T19:18:01.18+00:00

Hi Akhilesh Vallamkonda, thank you for the reply.

So I've tried obtaining a token, however when I follow the link you provided (https://learn.microsoft.com/en-us/azure/active-directory-b2c/access-tokens), I get stuck at the part where I insert the scope name in the authorization endpoint, as I do not have any scopes listed. Do I need to add a scope?
Akhilesh Vallamkonda 15,340 Reputation points Moderator

2025-01-28T19:43:34.03+00:00

@hawthorne91
yes, in order to get access token, you need scope, which is <application-ID-URI> - The application identifier URI that you set under Expose an API blade of the client application.

<scope-name> - The name of the scope that you added under Expose an API
hawthorne91 240 Reputation points

2025-01-28T20:00:10.1666667+00:00

Hi Akhilesh Vallamkonda,

Thank you for the response! Currently this portal is pushed out to external users, will creating a scope make the portal inactive? I just don't want to shut down portal functionality by creating the scope.
hawthorne91 240 Reputation points

2025-01-29T16:07:57.51+00:00

Hi again Akhilesh Vallamkonda,

Sorry for the multiple responses! I was able to obtain a token via https://login.microsoftonline.com/{tenant}.onmicrosoft.com/oauth2/v2.0/token, without creating a scope. Hopefully this is the proper way to do it, however please feel free to tell me if I need to create a scope.

Checking https://jwt.ms, the exp value for the token is a hour and 5 minutes after the iat time, which is very different from the 15 minute timer I've configured these tokens for. How should I proceed?
Akhilesh Vallamkonda 15,340 Reputation points Moderator

2025-01-29T18:52:11.94+00:00

Hi @hawthorne91
This seems it require further troubleshooting, could you please send us an email on azcommunity [at] microsoft [dot] com referencing this issue with a subject line "ATTN:akhilesh"

Share via

Mismatch in Azure B2C Token Expiry with Configured Session Lifetime in API Management

1 answer

Your answer