Unable to retrieve access token from authorisation code for Azure app

Question

I am doing SSO to Azure AD for my Azure app using passport-azure-ad library. Following is the options object :

const options = {
    identityMetadata: process.env.AZUREAD_IDENTITY_METADATA,
    clientID: process.env.AZUREAD_AUTH_CLIENT_ID,
    responseType: 'code id_token',
    responseMode: 'form_post',
    redirectUrl: process.env.AZUREAD_REDIRECT_URL,
    allowHttpForRedirectUrl: true,
    clientSecret: process.env.AZUREAD_AUTH_CLIENT_SECRET,
    validateIssuer: false,
    issuer: null,
    passReqToCallback: true,
    useCookieInsteadOfSession: true,
    cookieEncryptionKeys: [
        { key: '********************************', iv: '************' },
        { key: '********************************', iv: '************' },
    ],
    scope: ['profile', 'offline_access', 'https://graph.microsoft.com/mail.read'],
    loggingLevel: 'info',
    nonceLifetime: null,
    nonceMaxAmount: 5,
    clockSkew: null,
};

After getting authorisation code (req.body.code) from the AD callback, I am using that to retrieve access token for my app using adal-node library. Relevant code snippet -

const authenticationContext = new AuthenticationContext(
            `https://login.microsoftonline.com/<tenant>.onmicrosoft.com`,
        );
        authenticationContext.acquireTokenWithAuthorizationCode(
            req.body.code,
            process.env.AZUREAD_REDIRECT_URL,
            process.env.AZUREAD_AUTH_CLIENT_ID,
            process.env.AZUREAD_AUTH_CLIENT_ID,
            process.env.AZUREAD_AUTH_CLIENT_SECRET,
            function(err, response) {
                let message = '';
                if (err) {
                    message = 'error: ' + err.message + '\n';
                }
                message += 'response: ' + JSON.stringify(response);

                if (err) {
                    console.log(message);
                    return;
                }
...

But this method is resulting in following error:

"error": "invalid_grant",
    "error_description": "AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token.\r\nTrace ID: 539cdaf3-460d-43fa-b4bb-6f23a8058800\r\nCorrelation ID: 507aafd9-5a4a-4417-b1f8-9fe4a5bc4cd3\r\nTimestamp: 2020-02-28 13:10:27Z",
    "error_codes": [
        54005
    ],

Also tried retrieving access token based on documentation (https://docs.microsoft.com/en-us/azure/active-directory/azuread-dev/v1-protocols-oauth-code#use-the-authorization-code-to-request-an-access-token) using Postman, but that also results in same error.

Kindly help me to figure out the mistake here.

If the answer is helpful, please accept it as answer( click on the check mark beside the answer to toggle it from greyed out to filled in). Thank you. — Tony Ju

Tony Ju Tony Ju · Accepted Answer · 2020-03-02T01:14:44

Azure AD will no longer accept authorization codes to issue tokens that have already been used.

You need to get a new Authorization code every time. Also, you can change your code to request a refresh token that will be passed to /used by additional resources as the refresh tokens can still be reused.

Reference:

https://social.msdn.microsoft.com/Forums/en-US/4192e141-309a-4dd6-a5c9-f1a8ce32f4ca/aadsts54005-oauth2-authorization-code-was-already-redeemed

Unable to retrieve access token from authorisation code for Azure app

1 Answers