New-PartnerAccessToken does not returns refresh token

[slavizh]

Steps to reproduce

What steps can reproduce the defect?
Please share the setup, commandline for vstest.console, sample project, target
framework etc.

Refresh Token was issued with commands in v 1.5 of the module. It follows the standard way of creating SP, creation impersonation with the SP of a user that has global administrator and admin agent rights. Nothing out of the ordinary.

$p=New-PartnerAccessToken -ApplicationId "<app id>" -Credential (Get-Credential) -RefreshToken $token -Scopes 'https://api.partnercenter.microsoft.com/user_impersonation' -ServicePrincipal -Tenant <tenant id>  
$p.RefreshToken

$p.RefreshToken is empty. Only access token is filled.

Expected behavior

Share the expected output
Expected output should contain Refresh token

Actual behavior

What is the behavior observed?

No refresh token is returned, only access one.

Diagnostic logs

Please share test platform diagnostics logs.
The logs may contain test assembly paths, kindly review and mask those before sharing.

Environment

Please share additional details about your environment.
Version

Both 5.1 and 6.2.3

[ghost]

@slavizh thank you for opening this new issue. When you generate a new access token using any refresh token, that refresh token should be injected into the cache. After that is accomplished everything should function as excepted. There is a possibility that what you stated in the other thread is correct, but that definitely is not the expected behavior. So, we will need to dig into this further to see how best to reproduce the issue.

[slavizh]

If I try to generate new refresh token I get error on the web page after entering credentials:

AADSTS50011: The reply url specified in the request does not match the reply urls configured for the application:

I am using the following command assuming it is the right way to issue the refresh token for the first time.

$t=New-PartnerAccessToken -ApplicationId '<app id>' -Credential (Get-Credential) -Scopes 'https://api.partnercenter.microsoft.com/user_impersonation' -ServicePrincipal -Tenant '<tenant id>' -UseAuthorizationCode

[slavizh]

BTW when problems happen in the broswer you can never cancel the command on the PowerShell window. You should have some time out or ability to cancel the command otherwise I have to close the whole window.

[cblackuk]

I have not managed to test it yet since the new release but I bank my money @slavizh is correct. Plus the issue of not being able to cancel is so annoying it is beyond belief... especially that the new module is so broken that you end up testing all of it 530403403400 times a day - needed to restart everything each time...

[cblackuk]

Also I did mention in my last issue that Refresh Tokens are not being returned... I do not know C# well enough but when I read the code it does not appear to have the right property assigned to it.

            string key = GetTokenCacheKey(authResult);

            AuthResult result = new AuthResult(
                authResult.AccessToken,
                authResult.IsExtendedLifeTimeToken,
                authResult.UniqueId,
                authResult.ExpiresOn,
                authResult.ExtendedExpiresOn,
                authResult.TenantId,
                authResult.Account,
                authResult.IdToken,
                authResult.Scopes);

            if (tokens.ContainsKey(key))
            {
                result.RefreshToken = tokens[key].Secret;
            }

            WriteObject(result);
        }

Surely authResult.RefreshToken should exist somewhere here?

[slavizh]

I do not know if this will help with reply url but here is mine. This is what was suggested when we first started this authentication model. As far as I can see the redirect url in the module is using localhost. Could that also cause the issue where the refresh token is not returned?

[slavizh]

If I put reply url https://localhost as well I can do interactive authentication. Seems you have changed the reply URL. Can you set it back to urn:ietf:wg:oauth:2.0:oob so we do not have to change our apps?

I still cannot get refresh token even when I have made this change,

[cblackuk]

It has got nothing to do with what is setup in your App but everything to do with the code inside the command.

When I run the "fixed" code and check in fiddler:

So when we run this:

New-PartnerAccessToken -ApplicationId $SPNClientId -Credential $Credentials -RefreshToken $SPNRefreshToken -Scopes 'https://api.partnercenter.microsoft.com/user_impersonation' -ServicePrincipal -Tenant $TenantId

We get:

RefreshToken            : 
AccessToken             : eyJ0eXAiOiJxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
                          sSD-mWE2TO-ksI8fA
IsExtendedLifeTimeToken : False
UniqueId                : xxxxx-xxxx-xxx-xxxx-xxxxx
ExpiresOn               : 9/16/2019 8:20:18 AM +00:00
ExtendedExpiresOn       : 9/16/2019 8:20:18 AM +00:00
TenantId                : xxxxx-xxxx-xxx-xxxx-xxxxx
Account                 : Account username: xxxxxxxxxxxxxx@xxxxxxxxxxx.onmicrosoft.com environment login.windows.net home account id: AccountId: 
                          xxxxx-xxxx-xxx-xxxx-xxxxx.xxxxx-xxxx-xxx-xxxx-xxxxx
IdToken                 : eyJ0eXxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
                         
Scopes                  : {https://api.partnercenter.microsoft.com/user_impersonation}
User                    : 

But API is returning the Refresh Token correctly (see Fiddler) but the command is written in a way so it does not.

[slavizh]

@cblackuk Thanks for running this trough Fiddler. Do you get also reply URL issue if you try to issue completely new refresh token. I would assume yes if you have setup the app as me.

[cblackuk]

The code above should issue a new token and it does but it does not get returned... until they fix it... no point testing anything else really :-)

[slavizh]

I was wondering if you get the same AAD error when you use -UseAuthorizationCode parameter but anyway. I hope they will resolve that problem as well.

[cblackuk]

Will test it tomorrow mate :)

[cblackuk]

You were 150% right mate:

[slavizh]

Thanks for testing it.

[slavizh]

2.0.1909.3 does not fixes refresh token not returned. :(

[cblackuk]

Why am I not surprised... I guess the reply URL is also broken still right?

[slavizh]

Haven't tested that but it is useless to test it if refresh token does not work.

[cblackuk]

Just tested both.

No refresh token and reply URL is broken still.

[LeonJansen]

Same here, issue still persists.

[slavizh]

@IsaiahWilliams Several days have passed and the only update was merged that didn't fixed the issue. Is the issue is investigated? Do we need to provide more information? When we can expect a fix?

[ghost]

Refresh tokens are valid for 90 days, so while this issue is being debugged you should not encounter any issue with using the current value. Also, I just released version 2.0.1909.4 that adds the ability to get debug statements from MSAL. Can you update and run the command with and without the debug flag please?

[slavizh]

@IsaiahWilliams We have automation that renews tokens every day. We cannot migrate if we are not able to run it. ran the new version. refresh token is still not available. Debug is below:

DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:13 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] MSAL MSAL.CoreCLR with assembly version '3.0.8.0', file version '3.0.8.0' and informational version '3.0.8+5db620ee347d54948b2775699985ae7a4d2bef1a'.  TelemetryCorrelationId(bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   Confirm                                                                                                                                                                                                                                                                         Continue with this operation?                                                                                                                                                                                                                                                   [Y] Yes  [A] Yes to All  [H] Halt Command  [S] Suspend  [?] Help (default is "Y"): a                                                                                                                                                                                            DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:13 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] Using 1 scopes for acquire token by refresh token request
DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:13 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d]                                                                                                                                                       === Request Data ===
Authority Provided? - True
Scopes - https://api.partnercenter.microsoft.com/user_impersonation
Extra Query Params Keys (space separated) -
DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:13 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] === Token Acquisition (ByRefreshTokenRequest) started:
 Cache Provided: True
 Authority Host: login.microsoftonline.com
DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:13 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] Resolving authority endpoints... Already resolved? - TRUE                                                                                             DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:14 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] Checking client info returned from the server..                                                                                                       DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:14 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] Saving Token Response to cache..                                                                                                                      DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:14 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] Looking for scopes for the authority in the cache which intersect with https://api.partnercenter.microsoft.com/user_impersonation                     DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:14 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] Intersecting scope entries count - 0
DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:14 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] Matching entries after filtering by user - 0                                                                                                          DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:14 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] Saving RT in cache...                                                                                                                                 DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:14] Serializing token cache with 1 items.                                                                                                                                                        DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:14 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] === Token Acquisition finished successfully. An access token was returned with Expiration Time: 09/20/2019 16:45:13 +00:00 ===

[ghost]

@slavizh thank you for sharing this information. Just to confirm the refresh token value was still missing when you ran the command with this version correct?

[slavizh]

@IsaiahWilliams yes

[ghost]

@slavizh that is interesting because the debug logs state the refresh token returned was cached. Can you confirm that C:\Users\<username>\AppData\Local\.IdentityService is empty as well?

[slavizh]

@IsaiahWilliams

[ghost]

@slavizh thank you for sharing that. There should be a file named msal.cache in that directory. I am not sure what is happening just yet, but that is the reason the refresh token value is missing. The token cache is not persisting to storage. I was able to reproduce the issue and then I got it corrected in my environment. Let me keep digging to see what is causing this inconsistent behavior.

[cblackuk]

Good luck and fingers crossed :) @IsaiahWilliams

[ghost]

@slavizh the root cause for this issue has been identified and corrected. Can you update to version 2.0.1909.5 and let me know if the value is returning as expected now?

[slavizh]

@IsaiahWilliams I have verified that version 2.0.1909.5 produces token. Thank you for fixing this!

[ghost]

Awesome that is great news. It was a rather interesting issue, but the good news it is resolved now. Thank you for bearing with me while I worked to get everything sorted.

[prysmcorp]

Trying to generate a new token but receiving the following error

AADSTS50011: The reply url specified in the request does not match the reply urls configured for the application

I'm running 2.0.1909.5. This occurs right after the consent in the browser on a fresh setup. Reply URI set correctly on app to "urn:ietf:wg:oauth:2.0:oob"

Anyone else running into this issue?

[cblackuk]

@prysmcorp #158

Add https://localhost - job done

[prysmcorp]

That was definitely it. Thank you, sir!

[bilalAchahbar]

hello I know this is closed but I've updated the module to the "2.0.1909.5 " version but I as well don't have a refreshcode.
The localhost solution did fixed my reply url.
@slavizh I was wondering what you mean by automating to refresh the token.
This is my code.

$appId = 'hello'
$appSecret = 'world' | ConvertTo-SecureString -AsPlainText -Force
$tenantId = 'tenant'

#Perform this code if the refreshtoken is expired
$credential = New-Object System.Management.Automation.PSCredential $appId, $appSecret
$credential = Get-Credential
$token = New-PartnerAccessToken -ApplicationId $appId -Scopes 'https://api.partnercenter.microsoft.com/user_impersonation' -ServicePrincipal -Credential $credential -Tenant $tenantId -UseAuthorizationCode
$token.RefreshToken  | Out-File "C:\CSP\Refreshtoken.txt"



$refreshToken = "the token that was found inside C:\CSP\Refreshtoken.txt" "

# This will create a new accesstoken based on the refreshtoken so that the script will run automatically without any user interaction
$Newtoken = New-PartnerAccessToken -RefreshToken $refreshToken -Credential $credential -Scopes 'https://api.partnercenter.microsoft.com/user_impersonation' -ApplicationId $appId -ServicePrincipal -Tenant $tenantId -ErrorVariable ExpiredToken
Connect-PartnerCenter -AccessToken $Newtoken.AccessToken

[ghost]

@bilalAchahbar the root cause for this issue was related to how the module was being published. Since you have updated to a version where this has been corrected and your are still having issues please open a new issue. If you do open a new issue please include details about what exactly is missing.

[nitubhaskar]

I am unable to obtain refresh token with PowerShell 7.0.3 in ubuntu 18.04. It does provide refresh token if i try in windows powershell 5.1.19041.1
Command to reproduce the issue - New-PartnerAccessToken -UseDeviceAuthentication -ApplicationId 'a0c73c16-a7e3-4564-9a95-2bdf47383716' -Scopes 'https://outlook.office365.com/.default';

[pavlekukric]

We have the same issue.
Powershell module version is "3.0.10 PartnerCenter" and Refresh Token is not included in the response. All other properties are presented, only the Refresh token is missing. Also, it works on my machine (Refresh token is returned), but when I deploy it on prod server, it missing...
Any additional ideas or suggestions?

[username-is-already-taken2]

I don't think this issue should be closed, I'm getting the same issue using 3.0.10 of the partnerCenter version 7.2.1 Powershell (mcr.microsoft.com/powershell:lts-centos-7) mcr.microsoft.com/powershell@sha256:30d3936bc0d74b20e0ec90077155db6db050443f5e2fd666ccba04ae2e5235d8