Microsoft-identity-web: ITokenAcquisition token refresh and expiration

[mgmccarthy]

Documentation Related To Component:

https://docs.microsoft.com/en-us/dotnet/api/microsoft.identity.web.itokenacquisition.getaccesstokenforappasync?view=azure-dotnet-preview
https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-web-app-call-api-app-configuration?tabs=aspnetcore
https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-web-app-call-api-acquire-token?tabs=aspnetcore
https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-web-app-call-api-call-api?tabs=aspnetcore

Please check those that apply

• [ ] typo
• [x ] documentation doesn't exist
• [x ] documentation needs clarification
• [ ] error(s) in example
• [ x] needs example

Description Of The Issue

I'm currently injecting ITokenAcquisition and invoking GetAccessTokenForAppAsync in order to attain an access token from Azure AD.

I've wired it up using AddInMemoryTokenCaches. This is my code from Startup.cs:

services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(Configuration)
    .EnableTokenAcquisitionToCallDownstreamApi(new[] { Configuration["scopes"] })
    .AddInMemoryTokenCaches();

My question is does the implementation of ITokenAcquisition handle getting a refresh token when a currently cached token is nearing expiration? Aka, do I have to explicitly manage this in my code? If so, where is a good sample/docs of how to do that?

Also, if ITokenAcquisition does not handle token refresh based on expiration, will using IDownstreamWebApi handle it?

An example of where documentation is clear is when I used IdentityModel as my OIDC/OAuth2.0 library against Auth0 as the IdentityProvider.

On the Overview page, it clearly states (before diving into specifics or implementation) what you can expect to get out of using the library:

• automatic refresh of expired access tokens
• refresh token revocation
• token lifetime automation for HttpClient

Thanks

[bgavrilMS]

@mgmccarthy - I believe you want to reopen this issue on https://github.com/AzureAD/microsoft-identity-web
ITokenAcquisition is not an interface on MSAL, but on Microsoft.Identity.Web ( a higher level API over MSAL for ASP.NET Core).

[jmprieur]

@mgmccarthy : no need to recreate. I just moved it to the Microsoft.Identity.Web repo.

[jmprieur]

@mgmccarthy
yes, Microsoft.Identity.Web (whether you use ITokenAcquisition , IDownstreamApi or even GraphServiceClient) takes care of all this. It leverages MSAL.NET . See https://docs.microsoft.com/azure/active-directory/develop/msal-overview which provides the value of the MSAL libraries.

We'll make sure we are explicit about that
cc: @mmacy

[mgmccarthy]

Thanks @bgavrilMS and @jmprieur! I now know a little more about how Microsoft.Identity.Web leverages MSAL, and what library ITokenAcquisition belongs to ;)

Looking at the msal-overview link supplied above, it does state:

"Maintains a token cache and refreshes tokens for you when they are close to expire. You don't need to handle token expiration on your own."

I was having a hard time finding this page when searching to terms like "msal and token refresh" and "Microsoft.Identity.Web and token refresh" are not bringing up the overview page in the top search results. Instead, I'm getting funneled to pages like:

• https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-net-token-cache-serialization
• https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes
• https://docs.microsoft.com/en-us/azure/active-directory/develop/security-tokens
• https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-acquire-cache-tokens

where there are some mentions of refresh further down in the docs, but nothing like on the MSAL overview page where it's up top.

Thanks!