Successful auth token, but no refresh token...

[kitplummer]

Am using the authorization_code flow and am successfully receiving the code and access_token, but am not seeing how to or where the refresh_token is set. In the the local file store - it is set to null. Any pointer to how to get and use the refresh_token to update the access_token?

Looking at the doc, it should be available with the authorization code request (I think): https://learn.microsoft.com/en-us/graph/auth-v2-user

[DevLazio]

You have to request it with the corresponding method.
Here is my entire code flow :

 let token_url = format!(
        "https://login.microsoftonline.com/{}/oauth2/v2.0/token",
        tenant_id
    );

    let mut oauth = OAuth::new();
    oauth
        .client_id(client_id)
        .client_secret(client_secret)
        .add_scope("https://graph.microsoft.com/.default")
        .access_token_url(&token_url)
        .refresh_token_url(&token_url)
        .response_type("code");

    let mut request = oauth.build_async().client_credentials();
    let access_token = request.access_token().send().await?;
    let refresh_token = request.refresh_token().send().await?;

[DevLazio]

That's weird !

And I agree with you, the refresh_token is in the first response.
I can see it in the debugger if I stop the execution on let access_token = match request.access_token().send().await {

And it matches the one printed by println!("{:?}", oauth.get_refresh_token());

[kitplummer]

Do you see it if you use/set the GrantType to authorization_code?

[kitplummer]

If I run the debugger using let mut request = oauth.build_async().authorization_code_grant(); the refresh_token is always None.

[DevLazio]

Yeah, I'm using the authorization_code_grant().

I tried a few things and I found that if I removed the
.add_scope("offline_access") line from https://github.com/sreeise/graph-rs/blob/master/examples/oauth/auth_code_grant.rs
to match your configuration of OAuth I no longer get any refresh_token.

And if I put it back, it works again.
Here is my full OAuth config :

 oauth
        .client_id("[REDACTED]")
        .client_secret("[REDACTED]")
        .add_scope("tasks.readwrite")
        .add_scope("user.read")
        .add_scope("offline_access")
        .redirect_uri("http://localhost:8001/redirect")
        .authorize_url("https://login.microsoftonline.com/[REDACTED]/oauth2/v2.0/authorize")
        .access_token_url("https://login.microsoftonline.com/[REDACTED]/oauth2/v2.0/token")
        .refresh_token_url("https://login.microsoftonline.com/[REDACTED]/oauth2/v2.0/token");

I had to add the client secret and tenant_id because of the way my Azure app is configured and change the localhost port because of another service running on my machine.

Hope this helps.

[kitplummer]

I am so grateful for your help here. The .add_scope("offline_access") option was it. Again, many thanks! Would love to buy you a beer or glass of wine and celebrate!

I did just go back through the docs to see if this is mentioned anywhere. Duh, it is plainly stated. :D

With the Microsoft identity platform endpoint, permissions are requested using the scope parameter. In this example, the Microsoft Graph permissions requested are User.Read and Mail.Read, which will allow the app to read the profile and mail of the signed-in user. The offline_access permission is a standard OIDC scope that is requested so that the app can get a refresh token. The app can use the refresh token to get a new access token when the current one expires.