Requesting refresh token fails.No refresh tokens were found in the token store

1
votes

I'm trying to get refresh token for Google from App Services,but I can't.

Log says

2016-11-04T00:04:25 PID[500] Verbose Received request: GET https://noteappsvr.azurewebsites.net/.auth/login/google?access_type=offline 2016-11-04T00:04:25 PID[500] Verbose Downloading OpenID configuration from https://accounts.google.com/.well-known/openid-configuration

2016-11-04T00:04:25 PID[500] Verbose Downloading OpenID issuer keys from https://www.googleapis.com/oauth2/v3/certs

2016-11-04T00:04:25 PID[500] Information Redirecting: https://accounts.google.com/o/oauth2/v2/auth?response_type=code&client_id=299597639...04000925%26redir%3D&access_type=offline

2016-11-04T00:05:17 PID[500] Verbose Received request: GET https://noteappsvr.azurewebsites.net/.auth/login/google/callback?state=nonce%3D5656e1dd...&prompt=none

2016-11-04T00:05:17 PID[500] Verbose Calling into external HTTP endpoint POST https://www.googleapis.com/oauth2/v4/token.

2016-11-04T00:05:18 PID[500] Information Login completed for '[email protected]'. Provider: 'google'.

2016-11-04T00:05:18 PID[500] Verbose Writing 'AppServiceAuthSession' cookie for site 'noteappsvr.azurewebsites.net'. Length: 728.

2016-11-04T00:05:18 PID[500] Information Redirecting: https://noteappsvr.azurewebsites.net/.auth/login/done#token=%7B%22authenti...d6ffa9924e5%22%7D%7D

2016-11-04T00:05:50 PID[500] Verbose Received request: GET https://noteappsvr.azurewebsites.net/.auth/refresh

2016-11-04T00:05:50 PID[500] Verbose JWT validation succeeded. Subject: 'sid:4fd4f6...', Issuer: 'https://noteappsvr.azurewebsites.net/'.

2016-11-04T00:05:50 PID[500] Warning The refresh request issued by sid:4fd4f6... failed because no refresh tokens were found in the token store.

2016-11-04T00:05:50 PID[500] Information Sending response: 403.80 Forbidden

There seem to be no refresh tokens in token store,but why? I turned on token store setting on portal already.

1
azureauthenticationazure-web-app-service

1 Answers

0
votes

If Google detects that it has already given your user a refresh token, then it will not give additional refresh tokens unless you explicitly prompt the user for consent. You can do this by adding the prompt=consent query string parameter to the login URL. In your case, https://noteappsvr.azurewebsites.net/.auth/login/google?access_type=offline&prompt=consent

Try this and see if that restores the Google refresh token.

Google documentation on this behavior can be found here (under the HTTP/REST tab): https://developers.google.com/identity/protocols/OAuth2WebServer#offline

Important: When your application receives a refresh token, it is important to store that refresh token for future use. If your application loses the refresh token, it will have to re-prompt the user for consent before obtaining another refresh token. If you need to re-prompt the user for consent, include the prompt parameter in the authorization code request, and set the value to consent.

In normal usage, the refresh token should not be lost. Let me know if you are seeing a case where it does get lost.