Azure-docs: Azure B2C refresh id_token returns incorrect auth_time

[damienbod]

When using OIDC code flow with PKCE and refresh tokens, the id_token returned in the refresh has an incorrect auth_time claim value. It returns the new issued time, and not the original.

From the OIDC specs

its iat Claim MUST represent the time that the new ID Token is issued, if the ID Token contains an auth_time Claim, its value MUST represent the time of the original authentication - not the time that the new ID token is issued,

This is a bug in the public client Azure B2C implementation.

[TravisCragg-MSFT]

@damienbod can you post a link to the azure doc you are referring to?

[MarileeTurscak-MSFT]

The auth_time is the last time the application (or user) initiated an authentication attempt against Azure AD B2C. https://docs.microsoft.com/en-us/azure/active-directory-b2c/tokens-overview

Can you please link the implementation guide that you are following?

[damienbod]

@TravisCragg-MSFT @MarileeTurscak-MSFT

https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokenResponse

Greetings Damien

[MarileeTurscak-MSFT]

Hi @damienbod,

Thanks. Based on that doc there does appear to be a discrepancy. I have reported this and requested a fix.

[damienbod]

@MarileeTurscak-MSFT So will the Azure B2C implemention be fixed, because it has a bug, this is NOT a docs bug, but an Azure B2C server implementation bug. I was reporting the implementation bug here, because I have no idea where this should have been reported. Can you point me to the new issue?

Thanks and greetings Damien

[andrewhyson]

Can I also request a link to the new issue? I'd like to know if there are plans for this to be addressed or If I should find an alternative approach to using auth_time.