ASP.NET 5 OpenIdConnect Refresh_Token

Question

i'm trying to create a token with refresh_token

followed this post answer by @Shaun Luttin

public sealed class AuthorizationProvider : OpenIdConnectServerProvider
{
    public override Task ValidateClientAuthentication(
        ValidateClientAuthenticationContext context)
    {
        // Since there's only one application and since it's a public client
        // (i.e a client that cannot keep its credentials private), call Skipped()
        // to inform the server the request should be accepted without 
        // enforcing client authentication.
        context.Skipped();

        return Task.FromResult(0);
    }

    public override Task GrantResourceOwnerCredentials(
        GrantResourceOwnerCredentialsContext context)
    {
        // Validate the credentials here (e.g using ASP.NET Identity).
        // You can call Rejected() with an error code/description to reject
        // the request and return a message to the caller.

        var identity =
            new ClaimsIdentity(OpenIdConnectServerDefaults.AuthenticationScheme);
        identity.AddClaim(ClaimTypes.NameIdentifier, "todo");

        // By default, claims are not serialized in the access and identity tokens.
        // Use the overload taking a "destination" to make sure your claims
        // are correctly inserted in the appropriate tokens.
        identity.AddClaim("urn:customclaim", "value", "token id_token");

        var ticket = new AuthenticationTicket(
            new ClaimsPrincipal(identity),
            new AuthenticationProperties(),
            context.Options.AuthenticationScheme);

        // Call SetResources with the list of resource servers
        // the access token should be issued for.
        ticket.SetResources(new[] { "resource_server_1" });

        // Call SetScopes with the list of scopes you want to grant
        // (specify offline_access to issue a refresh token).
        ticket.SetScopes(new[] { "profile", "offline_access" });

        context.Validated(ticket);

        return Task.FromResult<object>(null);
    }
}

when i request for token like this

POST http://localhost:50000/connect/token HTTP/1.1
User-Agent: Fiddler
Host: localhost:50000
Content-Length: 61
Content-Type: application/x-www-form-urlencoded

grant_type = password & username = my_username & password = my_password

i'm getting token like this

{
  "resource": "resource_server_1",
  "scope": "profile offline_access",
  "token_type": "bearer",
  "access_token": "eyJh...W2rA",
  "expires_in": "3600"
}

its working fine but there is no refresh_token property init. how can i get that?

score 1 · Accepted Answer · answered Mar 01 '16 at 19:51

i dont know for some reason specifying

ticket.SetScopes(new[] { "profile", "offline_access" });

manually is not working, so i removed this line and added scope parameter to my request header, now i'm getting response with refresh_token

POST http://localhost:50000/connect/token HTTP/1.1
User-Agent: Fiddler
Host: localhost:50000
Content-Length: 61
Content-Type: application/x-www-form-urlencoded

grant_type = password & username = my_username & password = my_password & scope = offline_access

so now the response is

{
  "resource": "resource_server_1",
  "scope": "profile offline_access",
  "token_type": "bearer",
  "access_token": "eyJh...W2rA",
  "refresh_token": "CfDJ8OV0Bu....AoUWPE"
  "expires_in": "3600"
}

Yep, that's because in beta4, the `offline_access` scope was ignored if it was not present in the token request (even if you explicitly grant it). That's something I relaxed in the beta5 nightly builds. — Kévin Chalet, Mar 02 '16 at 01:10

ASP.NET 5 OpenIdConnect Refresh_Token

1 Answers1