[Bug] "email" scope forces token refresh even if there are valid cached tokens
See original GitHub issueMSAL 4.7.1 net45
- Desktop / Mobile
- Interactive
- Integrated Windows Auth
- Username Password
- Device code flow (browserless)
I use the following code to initialize IPublicClientApplication:
var client = PublicClientApplicationBuilder.Create(strClientId).Build();
client.UserTokenCache.EnableSerialization();
Where the implemetnation of UserTokenCache.EnableSerialization()
is taken from here: https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-net-token-cache-serialization#simple-token-cache-serialization-msal-only
Then I get a token multiple times using this line:
var authResult = await client.AcquireTokenSilent(new string[] {strCustomScope, "email"}, cachedTokenAccount).ExecuteAsync()
I get new tokens every time, even if I have valid (not expired) tokens in the cache. Because of that I get error introduced by this update: https://docs.microsoft.com/en-us/azure/active-directory/develop/reference-breaking-changes#march-2019
Removing “email” scope fixes this and I get tokens from the cache if not expired.
Issue Analytics
- State:
- Created 4 years ago
- Comments:18 (16 by maintainers)
Top Results From Across the Web
WithForceRefresh method does not seem to refresh the token
MSAL.NET does not expose refresh tokens, for security reasons: MSAL handles refreshing tokens for you with token cache. enter image description ...
Read more >Increase the resilience of authentication and authorization ...
Ensure apps serialize their token cache securely to persist the tokens between app instances. Reuse tokens during their lifetime. Refresh tokens ...
Read more >Refresh access tokens
A refresh token is a special token that is used to obtain additional access tokens. This allows you to have short-lived access tokens...
Read more >What Are Refresh Tokens and How to Use Them Securely
This post will explore the concept of refresh tokens as defined by OAuth 2.0. We will learn how they compare to other token...
Read more >RFC 6749 The OAuth 2.0 Authorization Framework
(B) The authorization server authenticates the client and validates the authorization grant, and if valid, issues an access token and a refresh token....
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
@bgavrilMS @henrik-me @jennyf19 @trwalke @neha-bhargava Give it’s external we might want to close it with a link from FAQs ? do you agree?
IMHO:
invalid_scope
- error for situation 1 above, would work, in a sense that AAD explicitly disallow the “consenting multiple resources in one interaction” usage. But if that is not the price we want to pay, then AAD and MSAL need to come up with a non-OutOfBand way to convey “hey this is an RT that will work for ALL scopes you just requested”. Perhaps something like this: