Cannot make Azure B2C refersh token become invalid

user3407039 0
Viewed 60

When a user logs out of Azure B2C using the MSAL library on a mobile device this only clears the local cache. The remote session on the server still exists which means any existing refresh tokens could still be used.

From searching I know that the Microsoft Graph API can be used to revoke the current user's sign in session, and therefore invalidate all current refresh tokens. I believe I am doing this, but the refresh tokens keep remaining active.

Here is my flow:

I get a token for user A (I tried this with auth code flow and ROPC but I don't believe that should make a differnce).

I confirmed that I can get a new access token by using the current refresh token that is returned in a Postman call -

{{b2c_login_url}}/B2C_1_ROPC_SignIn/oauth2/v2.0/token?grant_type=refresh_token&client_id={{b2c_ropc_client_id}}&refresh_token=xxxxx&scope={{b2c_scopes}}&redirect_uri={{b2c_api_redirect_uri}}

This returns a new access token as expected.

I then take the azure userId value ("oid" property in the access token) and pass that through to my API that then runs the following code.

        var graphClient = GetGraphClient();
           
        var result = await graphClient.Users["{" + userId + "}"]
            .RevokeSignInSessions()
            .Request()
            .PostAsync();

        return result.GetValueOrDefault();

I can see that the result of this expression is true. I can also go onto the Azure B2C user details and see that "StsRefreshTokensValidFrom" has been updated to the current date time as expected.

B2C user audit details

Now, I run the exact same http request I ran previously using the refresh token to get another access token, but this time, it should fail. However, I continue to get new access tokens.

The strange thing is that I am sure I tested this previously, tried to get a new token, and it failed as I'd expect. But now it will always return me new tokens.

I feel I am missing something here. Any advice?

refresh-token azure-ad-b2c authentication azure
1 Answers

I tried to reproduce the same in my environment and got below results:

I generated token for a B2C user using ROPC flow via Postman with parameters as below:

POST https://<tenant_name>.b2clogin.com/<tenant_name>.onmicrosoft.com/<policy>/oauth2/v2.0/token
client_id : xxxxx-xxxx-xxxx-xxxxxxxx
grant_type : password
scope : https://<tenant_name>.onmicrosoft.com/web_api/api.read offline_access
username : b2c_username
password : password

Response:

enter image description here

Using the above refresh token, I'm able to generate access token successfully like below:

POST https://<tenant_name>.b2clogin.com/<tenant_name>.onmicrosoft.com/<policy>/oauth2/v2.0/token
client_id : xxxxx-xxxx-xxxx-xxxxxxxx
grant_type:refresh_token
scope:https://<tenant_name>.onmicrosoft.com/web_api/api.read
redirect_uri:https://jwt.ms
refresh_token:paste_refresh_token

Response:

enter image description here

To revoke refresh tokens, I ran below query via Graph Explorer like this:

POST https://graph.microsoft.com/beta/users/<user_id>/invalidateAllRefreshTokens

Response: enter image description here Code Sample in C#:

GraphServiceClient graphClient = new GraphServiceClient( authProvider );
await graphClient.Users["userid"]
.InvalidateAllRefreshTokens()
.Request()
.PostAsync();

To confirm that, I checked user's details in Portal like below:

enter image description here

When I tried to get access token with same refresh token, I got error saying token is revoked like below:

enter image description here

After revoking the tokens from Graph API, it may take up to 5 minutes to work.

If you run the query for access token as soon as you revoked the refresh tokens, you may still get access token.

So, wait for 5-10 minutes and try to get the access token with same query. Then, you won't be getting access token as the refresh token will be revoked at that time.

usert0Id10
Related