Repository navigation
[Question]: Why refreshing a token yields an AADSTS90009 error? #1844
Description
What Version of the library are you using?
v16.0.1
Question
I have multi-tenant application with the following configuration:
authority: 'https://login.microsoftonline.com/common/v2.0',
authWellknownEndpointUrl: 'https://login.microsoftonline.com/common/v2.0',
redirectUrl: window.location.origin + '/home',
postLogoutRedirectUri: window.location.origin + '/login',
clientId: '<clientId>',
scope: 'openid profile offline_access api://<clientId>/app',
responseType: 'code',
silentRenew: true,
ignoreNonceAfterRefresh: true,
maxIdTokenIatOffsetAllowedInSeconds: 600,
issValidationOff: true,
autoUserInfo: false,
useRefreshToken: true,
customParamsAuthRequest: {
prompt: 'select_account' // login, consent
},
logLevel: LogLevel.Debug
Log in works and an access token is returned. Then if I do this:
this.oidcSecurity.forceRefreshSession().subscribe((loginResponse) => {
console.log(loginResponse);
});
I am getting a 400 Bad request with the following error message:
"AADSTS90009: Application ''() is requesting a token for itself. This scenario is supported only if resource is specified using the GUID based App Identifier.
Honestly, I'm feeling a bit lost here. What's wrong? What am I supposed to do?
Activity
kagklis commentedon Sep 21, 2023
Based on the documentation, in order to get a refresh token, there are several required parameters you need to pass.
One of them turns out to be the scope, which for some reason is not passed into the payload of the request.
Adding the following in my configuration resolved the issue: