search

Azure-Samples / active-directory-b2c-custom-policy-starterpack

Azure AD B2C now allows uploading of a Custom Policy which allows full control and customization of the Identity Experience Framework
http://aka.ms/aadb2ccustom
MIT License
339 stars 395 forks source link

RedeemRefreshToken UserJourney throws AADB2C90085 #138

Open michiproep opened 2 years ago

michiproep commented 2 years ago

I have updated my policy as suggested in the readme regarding to new refresh token journey. I did upload my files successfully, I can get a refresh token via auth_code flow but as soon as I call the token endpoint with grant_type refresh_token I end up with { "error": "invalid_grant", "error_description": "AADB2C90085: The service has encountered an internal error. Please reauthenticate and try again.\r\nCorrelation ID: 187ac3ca-a228-4a22-bc60-baf70b904174\r\nTimestamp: 2022-09-29 15:34:23Z\r\n" }

As soon as I remove the <Endpoint Id="Token"...> part, I can get new token via refresh_token.

  1. Is there a way to debug that? Because AppInsights doen't show anything about the new journey.
  2. Also, what is the difference between this new way of doing RefreshTokensJourney (via "Endpoint") in comparison to that metaData key in the JwtIssuer technical profile (RefreshTokenUserJourneyId) ?
  3. Does "Endpoint Id="Token"" also affect clientcredentials flow or auth_code flow since they all use the tokenendpoint?
michiproep commented 2 years ago

Update: I could make it work - basically! Since I did extend the TP AAD-UserReadUsingObjectId, I was missing an OutputClaim in TP RefreshTokenReadAndSetup.

But there are still a lot of questions:

  1. What exactly gets extracted from the refreshToken and how does it relate to "PreserveOriginalAssertion"?
  2. Are "real" ClaimTypes used within the token or PartnerClaimTypes?
  3. There should be some documentation on how things work in detail
elKei24 commented 1 year ago

I totally agree that the topic of refresh tokens lacks a lot of documentation. In case someone stumbles across this issue while looking for some explanations like I did, I can at least provide the answer for 2. now.

The refresh token contains the same PartnerClaimTypes as the access token. They need to be mapped back to the "real" claim types when extracting them from the refresh token. The example should probably rather look something like this:

<OutputClaim ClaimTypeReferenceId="RESTAPIclaim1" PartnerClaimType="claim-1" />
<OutputClaim ClaimTypeReferenceId="IDPclaim2" PartnerClaimType="claim-2" />