Azure AD - id_token not refreshing

user_4848606 0
Viewed 334

I'm using AAD to lock down my azure web app and api. I am calling /.auth/me to retrieve the authenticated user's tokens, and then using the id_token to authenticate the user to the api. The id_token expires in 1 hour, which should be fine as you can call /.auth/refresh to get new tokens. Issue is that "refresh" only seems to refresh access_token and refresh_token, not id_token. Only way I can get a new id_token is if i open a fresh incognito and re-authenticate.

Any ideas on this? id_token is acceptable to lock down an api, no? access_token doesn't have claims on it so i'm interested in using id_token.

jwt azure-active-directory azure-web-app-service
1 Answers

Yes, we can not use refresh_token to renew an id_token. If you want to refresh an id_token, we can just re-authenticate for the id_token.

And in my opinion, if the id_token is just be used for passing user identity in a standardized structure (JWT) then the backend will treat it as a plain JWT and ignore the expiry. It will assume the called is authenticated.

user_110992130
Related