search

OfficeDev / office-js

A repo and NPM package for Office.js, corresponding to a copy of what gets published to the official "evergreen" Office.js CDN, at https://appsforoffice.microsoft.com/lib/1/hosted/office.js.
https://learn.microsoft.com/javascript/api/overview
Other
671 stars 96 forks source link

Token B still valid when click on logout in Outlook #4633

Closed iraviguggilam closed 2 months ago

iraviguggilam commented 3 months ago

We are using on_behalf_of SSO process in outlook Addin. Token A generated using OfficeRuntime.auth. getAccessToken

let bootstrapToken = await OfficeRuntime.auth.getAccessToken({ allowSignInPrompt: true, }); Below is the reference for on_behalf_of flow

protocols-oauth-on-behalf-of-flow

Issue is when User logout from outlook Token B( which is generated on top of Token A) is still valid.

mattgeim commented 3 months ago

@iraviguggilam - Is your question about the access token your middle tier receives from Microsoft Entra when doing the token exchange for the token it gets from Office when calling getAccessToken, or something else? If you are looking for more information on tokens on the Entra ID side, you can find relevant information that could help you here: https://learn.microsoft.com/en-us/entra/identity-platform/access-tokens

iraviguggilam commented 2 months ago

My Question is ( refer the image, shared earlier) Token A has some expire time, as I generated the Token B will be valid or not. If Token A expires ???

mattgeim commented 2 months ago

This is a question for the Entra ID team on On-Behalf-of flows and token issuance/expiration. You can find the options for doing so here:

https://learn.microsoft.com/en-us/entra/identity-platform/developer-support-help-options

Feel free to reopen this issue if I misunderstood your question.