3
votes

I am able to retrieve refresh tokens for my custom B2C policies but would like to increase the token lifetime to the max limit or set the sliding window lifetime to No Expiry.

This was able to be done via the Azure Portal B2C settings for Basic policies but is not available in the portal for custom policies.

https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-token-session-sso#token-lifetimes-configuration

How can I configure this in my policies?

2

2 Answers

5
votes

Check out this article.

Specifically add the following in your RP technical profile.

<Item Key="token_lifetime_secs">3600</Item>

Can look like this (copied from docs)

<ClaimsProviders>
   <ClaimsProvider>
      <DisplayName>Token Issuer</DisplayName>
      <TechnicalProfiles>
         <TechnicalProfile Id="JwtIssuer">
            <Metadata>
               <Item Key="token_lifetime_secs">3600</Item>
               <Item Key="id_token_lifetime_secs">3600</Item>
               <Item Key="refresh_token_lifetime_secs">1209600</Item>
               <Item Key="rolling_refresh_token_lifetime_secs">7776000</Item>
               <Item Key="IssuanceClaimPattern">AuthorityAndTenantGuid</Item>
               <Item Key="AuthenticationContextReferenceClaimPattern">None</Item>
            </Metadata>
         </TechnicalProfile>
      </TechnicalProfiles>
   </ClaimsProvider>
</ClaimsProviders>
0
votes

What Parakh said is correct but please take note of the banner on the page that he linked to which says the following about SPA apps with PKCE:

Note
Single-page applications using the authorization code flow with PKCE always have a refresh token lifetime of 24 hours while mobile apps, desktop apps, and web apps do not experience this limitation. Learn more about the security implications of refresh tokens in the browser.

That means that settings such as the following may not be respected for those apps:

  • refresh_token_lifetime_secs
  • rolling_refresh_token_lifetime_secs
  • allow_infinite_rolling_refresh_token
    • This last one is never respected for SPA w/ PKCE