How to get Refresh Token from Active Directory Access Token.?

Question

I have an Angular 6+ web application. The Web Page makes a request to the Azure Active directory through Microsoft ADAL, in order to get the user authenticated. The flow of authentication user works fine. The user gets a login page from Azure Active Directory. After successful authentication, I am getting an access token (JWT).

The problem I am facing is that, the token has an expiry time of 1 hour. The user automatically gets logged out after one hour due to token expiry. In order to avoid this, I am trying to refresh the token.

I read the following URL and understood that a refresh token could be used for refreshing the token. This is the OAuth 2.0 authorization code flow.

https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.clients.activedirectory.authenticationcontext.acquiretokensilentasync?view=azure-dotnet

However, in the flow that I have implemented, I do not see 'refresh_token' being sent in the response header. Following are the values that I see in the response header.

adal.expiration.key
adal.access.token.key
adal.session.state
adal.login.request.
appLanguage
adal.token.keys
adal.error
adal.error.description
adal.state.login
authToken
userid
module
adal.token.renew.status
adal.nonce.idtoken
adal.login.error
adal.idtoken

I red a lot of articles and questions in SO, but I have not understood how do I get a refresh token if I am getting a user authenticated through Azure Active Directory.

EDIT:

I red the following question in SO which is similar. Since this thread was written in 2016, I am not able to figure out how to setup "Auth settings" as mentioned in it.

https://stackguides.com/questions/36320641/how-to-configure-azure-ad-to-enable-refresh-tokens

juunas juunas · Accepted Answer · 2019-06-24T11:17:19

Sounds like you are using implicit grant flow. There are no refresh tokens in that flow. The way you refresh tokens is through a redirect, which can be done in a hidden iframe. ADAL.js or MSAL.js do the refresh for you in the background if necessary when you ask for tokens from them. Implicit grant flow requires the user session in AAD to be active at the time of refresh though.

How to get Refresh Token from Active Directory Access Token.?

1 Answers