OAuth refresh token from Azure Bot Service

user_925271 0
Viewed 694

I am using the OAuth capability in Azure Bot service to access the Microsoft Graph.

I have the need to communicate with the SharePoint Online REST endpoint. Typically, I would request and cache a refresh token from AAD, then use that refresh token to acquire a second access token, specifying the sharepoint.com address as the resource.

When using the OAuth connections in the Azure Bot service, I can get an access token by calling the GetUserToken method of the dialog context. However, I cannot get the refresh token from the bot service.

Q: Is the refresh token exposed as part of the BotBuilder library, or in some other fashion?

botframework
1 Answers

You must include the offline_access scope on your OAuth Bot configuration and on bots API permission within your Azure bot registration (Go to AAD - Application Registration (Preview) - API Permission).

Otherwise the bot service will not be able to refresh the token when it expired after 60 minutes by default.

For more information's on scopes see here.

Further explanation:

Without the offline_access scope included in the token request, the refresh token is not submitted and only an access token is provided. With the scope included, a refresh token will be provided to the caller which (in this case the bot service) can use to acquire a fresh token at any point until the refresh token itself expires.

user_27152290
Related