Azure refresh token expires despite using a confidential client

Question

I'm using a Web App/API azure application for a web application and used authorization grant flow with client_id and client_secret to get the access/refresh tokens (using rest API), everything worked fine, except the refresh token that has expired after 90 days. The expectation is to have a refresh_token that never expires (unless explicitly revoked) as stated in azure documentation.

This is what Microsoft AzureAD documentation says : (https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes#refresh-tokens)

Token lifetimes with confidential client refresh tokens Confidential clients are applications that can securely store a client password (secret). They can prove that requests are coming from the secured client application and not from a malicious actor. For example, a web app is a confidential client because it can store a client secret on the web server. It is not exposed. Because these flows are more secure, the default lifetimes of refresh tokens issued to these flows is until-revoked, cannot be changed by using policy, and will not be revoked on voluntary password resets.

This the definition of confidential clients based on RFC6749: (https://tools.ietf.org/html/rfc6749#section-2.1)

Clients capable of maintaining the confidentiality of their credentials (e.g., client implemented on a secure server with restricted access to the client credentials), or capable of secure client authentication using other means.

The error I'm getting now on refresh token request : AADSTS700082: The refresh token has expired due to inactivity. The token was issued on 2018-10-19T17:26:59.8511467Z and was inactive for 90.00:00:00.

Answer 1

You are not replacing the old refresh token with a fresh one, which is also provided whenever you make a call to get a new Access token using a refresh token.

The Refreshing the access tokens page explains this as follows.

Refresh tokens do not have specified lifetimes. Typically, the lifetimes of refresh tokens are relatively long. However, in some cases, refresh tokens expire, are revoked, or lack sufficient privileges for the desired action. Your application needs to expect and handle errors returned by the token issuance endpoint correctly.

When you receive a response with a refresh token error, discard the current refresh token and request a new authorization code or access token. In particular, when using a refresh token in the Authorization Code Grant flow, if you receive a response with the interaction_required or invalid_grant error codes, discard the refresh token and request a new authorization code.