No refresh token in acquireTokenOnBehalfOf response

Core Library

MSAL Node (@azure/msal-node)

Core Library Version

1.12.1

Wrapper Library

Not Applicable

Wrapper Library Version

None

Public or Confidential Client?

Confidential

Description

I’m working on a Teams app and integrating Graph API into some of the server side operations.

I first use the Teams SDK to request a token with the required scopes on the app client with an explicit consent dialog.

I then serve that token to the server side and use the MSAL Node OBO exchange acquireTokenOnBehalfOf to get the relevant Graph API token and then encrypt and store in the DB. I noticed that these token have an expiry of 1 hour, and I don’t get a refresh token to renew them.

This is a problem because acquiring Graph API related scopes using the Teams SDK requires an explicit consent dialog, and I can’t display that to my users every 24 hours.

MSAL Configuration

No response

Relevant Code Snippets

No response

Identity Provider

Azure AD / MSA

Source

External (Customer)

[bgavrilMS]

OBO flow is for web APIs, so it expected that there is no UI / invisible iframe or anything like that. See token caching https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-node/docs/caching.md - it shows how to persist the “whole” cache. If you don’t persist it, MSAL will store it in memory.

MSAL js does not have documentation around distributed token caching yet, which I think is what you’d want here.

Recommendation for a service at scale would be to not rely on token caching right now for OBO. Just cache the access token if you need to make multiple calls to Graph API. If the token is close to expiry or does not exist, invoke acquireTokenOnBehalfOf [again].

[bgavrilMS]

CC @Robbie-Microsoft as FYI