10

Let's say I have a provider-hosted app that's installed on a client's Office 365 site. A user clicks the app and they're redirected to our site.

The redirects gives us (among other things) a Refresh Token, so we can continue to make requests on the user's behalf, bound by their user permissions. All is well.

However, the Refresh Token expires after 6 months. How do we get another Refresh Token before this happens? Do we get a new token if they visit again before the expiry?

Improve this question

2 Answers 2

Reset to default
9
+100

You will have to have the user redirect back to the Office 365 site again to get a new refresh token. I had worked with MS on a project I was working on for my employer and they had indicated this to me. The unfortunate part is that the only real documentation that even says its 6 months is here: http://msdn.microsoft.com/en-us/library/jj687470.aspx. It does not elaborate on it very much at all.

In our project that uses the Office 365 integration, we are warning the users prior to the expiration to hopefully get a new refresh token before it expires.

Improve this answer
7
  • BTW, when you get a new access token using your refresh token (to make your connection), it does not provide a new refresh token. It will simply return the same one if you try to get the refresh token from your newly created access token. (I hope that made sense, LOL).
    – John Chapman
    Commented Oct 8, 2013 at 3:02
  • Ok, thanks. You said "hopefully" get a new token. Does that mean you're not sure if they log in they'll get a newer one before the old one expires? And yes, your token/token comment made sense to me. :)
    – Stu Pegg
    Commented Oct 8, 2013 at 7:26
  • Yes, we "hope" the user sees the message prior to the expiration so they can get a new one before it does. They don't always and in that case, they just wont have the functionality of the Office 365 connection until they do get a new token.
    – John Chapman
    Commented Oct 8, 2013 at 13:36
  • Ah! so you do get a new refresh token before the old one expires. That's good news, thanks.
    – Stu Pegg
    Commented Oct 8, 2013 at 14:15
  • 1
    If you go through the process to get a new access token (with the redirect to O365) and get your refresh token, it should be different each time. Basically asking them to "trust" the application again.
    – John Chapman
    Commented Oct 8, 2013 at 15:42
0

At the time of this reply, the refresh token expires after 6 months. There is one piece of information you get at least the first time the user accesses your app. The user will launch your app from the host web (at least for the first launch). You save the referrer URL of this POST call and use it to redirect the user any time they try to access without a context token AND if the refresh token is expired. This way, if the user is still active in Azure AD, they will get a new context token which will contain a new refresh token.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.