AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token or AADSTS70000: The provided value for the 'code' parameter is not valid. The code has expired.

[dboris65]

Expected behavior

Read events from the calendar and, and after that, if necessary, modify or save a new event.

Actual behavior

Scenario 1: work or school account
Read events from the calendar without problems.
Attempting to save a new event in the case of a work or school account produces the error message:
AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token.
Scenario 2: free account
Read events from the calendar without problems.
Attempting to save a new event in the case of a free account produces an error message:
AADSTS70000: The provided value for the 'code' parameter is not valid. The code has expired.

Steps to reproduce the behavior in Spring Boot web application

//Message controller class
    //...
    @GetMapping("/getMsCalendar")
    public Message startMessage() throws MalformedURLException {
        final Properties oAuthProperties = getOauthProperties();
        String authorizationUrl = Graph.getAuthUrl(oAuthProperties);
        return new Message( authorizationUrl );
    }
	//...
    @GetMapping("/redirect")
    public String callback(HttpServletRequest request, HttpServletResponse response) throws Exception {
        String returnStr = Graph.callback(request, response);
		//...
	}

//Graph class
//...
    public static String getAuthUrl(Properties oAuthProperties) throws MalformedURLException {
        String clientId = oAuthProperties.getProperty("app.clientId");    // ......-... 
        String tenantId = oAuthProperties.getProperty("app.tenantId");    // common
        redirectUri = oAuthProperties.getProperty("app.redirectUri");     // http://localhost:8080/redirect
        publicClientApplication = PublicClientApplication.builder(clientId)
                .authority("https://login.microsoftonline.com/" + tenantId)
                .build();
				
		//app.graphUserScopes=user.read,mail.read,mail.send,calendars.read,calendars.readwrite,openid,profile
        String scopes = oAuthProperties.getProperty("app.graphUserScopes"); 
        graphUserScopes = new HashSet<>(Arrays.asList(scopes.split(",")));

        AuthorizationRequestUrlParameters parameters = AuthorizationRequestUrlParameters
                .builder(redirectUri, graphUserScopes)
                .responseMode(ResponseMode.QUERY)
                .build();
        return publicClientApplication.getAuthorizationRequestUrl(parameters).toString();
	}
	
    public static String callback(HttpServletRequest request, HttpServletResponse response) throws Exception {
        String authorizationCode = request.getParameter("code");
        final Properties oAuthProperties = getOauthProperties();
        String clientId = oAuthProperties.getProperty("app.clientId");        // ......-... 
        String tenantId = oAuthProperties.getProperty("app.tenantId");        // common
        String clientSecret = oAuthProperties.getProperty("app.clientSecret");// ...
	//app.graphUserScopes=user.read,mail.read,mail.send,calendars.read,calendars.readwrite,openid,profile
        String scopes = oAuthProperties.getProperty("app.graphUserScopes");
        redirectUri = oAuthProperties.getProperty("app.redirectUri");         // http://localhost:8080/redirect
        AuthorizationCodeCredential authorizationCodeCredential = new AuthorizationCodeCredentialBuilder()
                .clientId(clientId)
                .clientSecret(clientSecret)
                .tenantId(tenantId)
                .authorizationCode(authorizationCode)  
                .redirectUrl(redirectUri)              
                .build();
        TokenCredentialAuthProvider authProvider = new TokenCredentialAuthProvider(authorizationCodeCredential);
        _userClient = GraphServiceClient.builder()
                .authenticationProvider(authProvider)
                .buildClient();
        multipleCalls();
	}
	
	public static void multipleCalls(){
        EventCollectionPage events = _userClient.me().calendar().events()
                .buildRequest()
                .get();
		//...				
        Event newEvent = createEvent(today, tomorrow, 15);
        _userClient.me().events()
                .buildRequest()
                .post(newEvent);		//Error message here
	}
//...
//Maven POM
		<dependency>
			<groupId>com.azure</groupId>
			<artifactId>azure-core</artifactId>
			<version>1.40.0</version>
		</dependency>
		<dependency>
			<groupId>com.microsoft.azure</groupId>
			<artifactId>msal4j</artifactId>
			<version>1.13.8</version>
		</dependency>
		<dependency>
			<groupId>com.microsoft.graph</groupId>
			<artifactId>microsoft-graph</artifactId>
			<version>5.58.0</version>
		</dependency>
		<dependency>
			<groupId>com.microsoft.graph</groupId>
			<artifactId>microsoft-graph-core</artifactId>
			<version>2.0.18</version>
		</dependency>
//...

When application receives the authorizationUrl, it redirects the user to login to their account.
After the user logs in, the callback() method is activated, which then calls the multipleCalls() method.

One action in multipleCalls() method (to save new event or event listing) works without problems.
During the second action (save event or event listing), the one of described error messages occur.
Error messages differ depending on whether the application accesses the data of a user who has a free account or a work or school account.

I previously searched stackoverflow and issue #977.
None of the above helped me.

[ramsessanchez]

Hi @dboris65 , according to the AuthCode documentation you will need to refresh this token by storing the refresh token and using another request to get another auth code since these are short lived.
https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow#refresh-the-access-token
Not sure if this is implemented in your code, I can't seem to find where you are storing the refresh token and refreshing the auth token.

[microsoft-github-policy-service]

This issue has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 4 days. It will be closed if no further activity occurs within 3 days of this comment.