如何配置 Azure AD 以启用刷新令牌 [英] How to configure Azure AD to enable refresh tokens

问题描述

我有一个链接到 Azure AD 的 Azure 应用服务/Web API，并且身份验证正在运行，但是客户端令牌将在 1 小时后过期，因此我想启用 OAuth refresh_token.当我检查在我的服务上调用/.auth/me 的结果时，我没有看到 refresh_token.应用服务上启用了令牌存储.

I have an Azure App Service / Web API linked to Azure AD and authentication is working, however client tokens are expiring after 1 hour, so I want to enable the OAuth refresh_token. When I inspect the results of calling /.auth/me on my service I don't see a refresh_token. Token store is enabled on the app service.

我已尝试将其添加到 Azure AD 清单中的 oauth2permissions 中，如下所示，但它没有出现(我已重新启动 App 服务并重新部署我的服务以防缓存令牌) :

I have tried to add it to the oauth2permissions in the Azure AD manifest as follows, but it doesn't appear (I have restarted the App service and redeployed my service in case of caching of tokens) :

"oauth2Permissions": [ 
    {
        "adminConsentDescription": "Allow the application to store a refresh token on behalf of the signed-in user.",
        "adminConsentDisplayName": "Refresh tokens",
        "id": "3AGH4D29-B64A-4A9A-8DBC-5DB3C8BBBD75",
        "isEnabled": true,
        "type": "User",
        "userConsentDescription": "Allow the application to store a refresh token on your behalf.",
        "userConsentDisplayName": "Store refresh token",
        "value": "refresh_token"
    }
]

我的尝试基于此处给出的指导:https://cgillum.tech/2016/03/07/app-服务令牌商店/

I have based my attempts on the guidance given here : https://cgillum.tech/2016/03/07/app-service-token-store/

推荐答案

我使用这里的指导解决了这个问题:https://cgillum.tech/2016/03/25/app-service-auth-aad-graph-api/

I resolved this using the guidance here : https://cgillum.tech/2016/03/25/app-service-auth-aad-graph-api/

基本上，您必须更新应用服务的身份验证设置.而且它没有 UI，所以我使用了 azure 资源浏览器.

Basically you have to update the auth settings of your app service. And there isn't a UI for it, so I used the azure resource explorer.

关键是将 AdditionalLoginParams 值设置为 ["response_type=code id_token", "resource=https://graph.windows.net"].

The key was setting the additionalLoginParams value to ["response_type=code id_token", "resource=https://graph.windows.net"].

这篇关于如何配置 Azure AD 以启用刷新令牌的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！