Partner-Center-PowerShell: New-PartnerAccessToken does not returns refresh token

Steps to reproduce

What steps can reproduce the defect? Please share the setup, commandline for vstest.console, sample project, target framework etc.

Refresh Token was issued with commands in v 1.5 of the module. It follows the standard way of creating SP, creation impersonation with the SP of a user that has global administrator and admin agent rights. Nothing out of the ordinary.

$p=New-PartnerAccessToken -ApplicationId "<app id>" -Credential (Get-Credential) -RefreshToken $token -Scopes 'https://api.partnercenter.microsoft.com/user_impersonation' -ServicePrincipal -Tenant <tenant id>  
$p.RefreshToken

$p.RefreshToken is empty. Only access token is filled.

Expected behavior

Share the expected output Expected output should contain Refresh token

Actual behavior

What is the behavior observed?

No refresh token is returned, only access one.

Diagnostic logs

Please share test platform diagnostics logs.
The logs may contain test assembly paths, kindly review and mask those before sharing.

Environment

Please share additional details about your environment. Version

Both 5.1 and 6.2.3

About this issue

Original URL
State: closed
Created 5 years ago
Reactions: 1
Comments: 39 (10 by maintainers)

Most upvoted comments

@slavizh thank you for sharing that. There should be a file named msal.cache in that directory. I am not sure what is happening just yet, but that is the reason the refresh token value is missing. The token cache is not persisting to storage. I was able to reproduce the issue and then I got it corrected in my environment. Let me keep digging to see what is causing this inconsistent behavior.

ghost on Sep 20, 2019

@bilalAchahbar the root cause for this issue was related to how the module was being published. Since you have updated to a version where this has been corrected and your are still having issues please open a new issue. If you do open a new issue please include details about what exactly is missing.

ghost on Nov 26, 2019

That was definitely it. Thank you, sir!

prysmcorp on Sep 26, 2019

Awesome that is great news. It was a rather interesting issue, but the good news it is resolved now. Thank you for bearing with me while I worked to get everything sorted.

ghost on Sep 21, 2019

@isaiahwilliams I have verified that version 2.0.1909.5 produces token. Thank you for fixing this!

slavizh on Sep 21, 2019

@slavizh thank you for sharing this information. Just to confirm the refresh token value was still missing when you ran the command with this version correct?

ghost on Sep 20, 2019

@isaiahwilliams We have automation that renews tokens every day. We cannot migrate if we are not able to run it. ran the new version. refresh token is still not available. Debug is below:

DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:13 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] MSAL MSAL.CoreCLR with assembly version '3.0.8.0', file version '3.0.8.0' and informational version '3.0.8+5db620ee347d54948b2775699985ae7a4d2bef1a'.  TelemetryCorrelationId(bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   Confirm                                                                                                                                                                                                                                                                         Continue with this operation?                                                                                                                                                                                                                                                   [Y] Yes  [A] Yes to All  [H] Halt Command  [S] Suspend  [?] Help (default is "Y"): a                                                                                                                                                                                            DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:13 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] Using 1 scopes for acquire token by refresh token request
DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:13 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d]                                                                                                                                                       === Request Data ===
Authority Provided? - True
Scopes - https://api.partnercenter.microsoft.com/user_impersonation
Extra Query Params Keys (space separated) -
DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:13 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] === Token Acquisition (ByRefreshTokenRequest) started:
 Cache Provided: True
 Authority Host: login.microsoftonline.com
DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:13 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] Resolving authority endpoints... Already resolved? - TRUE                                                                                             DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:14 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] Checking client info returned from the server..                                                                                                       DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:14 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] Saving Token Response to cache..                                                                                                                      DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:14 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] Looking for scopes for the authority in the cache which intersect with https://api.partnercenter.microsoft.com/user_impersonation                     DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:14 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] Intersecting scope entries count - 0
DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:14 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] Matching entries after filtering by user - 0                                                                                                          DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:14 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] Saving RT in cache...                                                                                                                                 DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:14] Serializing token cache with 1 items.                                                                                                                                                        DEBUG: MSAL Info False (False) MSAL 3.0.8.0 MSAL.CoreCLR N/A [09/20/2019 15:45:14 - bf5e5a32-3ed1-47da-b3ca-3fad629b5e7d] === Token Acquisition finished successfully. An access token was returned with Expiration Time: 09/20/2019 16:45:13 +00:00 ===

slavizh on Sep 20, 2019

@isaiahwilliams Several days have passed and the only update was merged that didn’t fixed the issue. Is the issue is investigated? Do we need to provide more information? When we can expect a fix?

slavizh on Sep 20, 2019

Same here, issue still persists.

LeonJansen on Sep 19, 2019

Haven’t tested that but it is useless to test it if refresh token does not work.

slavizh on Sep 19, 2019

Thanks for testing it.

slavizh on Sep 17, 2019

You were 150% right mate:

cblackuk on Sep 17, 2019

It has got nothing to do with what is setup in your App but everything to do with the code inside the command.

When I run the “fixed” code and check in fiddler: So when we run this:

New-PartnerAccessToken -ApplicationId $SPNClientId -Credential $Credentials -RefreshToken $SPNRefreshToken -Scopes 'https://api.partnercenter.microsoft.com/user_impersonation' -ServicePrincipal -Tenant $TenantId

We get:

RefreshToken            : 
AccessToken             : eyJ0eXAiOiJxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
                          sSD-mWE2TO-ksI8fA
IsExtendedLifeTimeToken : False
UniqueId                : xxxxx-xxxx-xxx-xxxx-xxxxx
ExpiresOn               : 9/16/2019 8:20:18 AM +00:00
ExtendedExpiresOn       : 9/16/2019 8:20:18 AM +00:00
TenantId                : xxxxx-xxxx-xxx-xxxx-xxxxx
Account                 : Account username: xxxxxxxxxxxxxx@xxxxxxxxxxx.onmicrosoft.com environment login.windows.net home account id: AccountId: 
                          xxxxx-xxxx-xxx-xxxx-xxxxx.xxxxx-xxxx-xxx-xxxx-xxxxx
IdToken                 : eyJ0eXxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
                         
Scopes                  : {https://api.partnercenter.microsoft.com/user_impersonation}
User                    :

But API is returning the Refresh Token correctly (see Fiddler) but the command is written in a way so it does not.

cblackuk on Sep 16, 2019

If I put reply url https://localhost as well I can do interactive authentication. Seems you have changed the reply URL. Can you set it back to urn:ietf:wg:oauth:2.0:oob so we do not have to change our apps?

I still cannot get refresh token even when I have made this change,

slavizh on Sep 16, 2019

I have not managed to test it yet since the new release but I bank my money @slavizh is correct. Plus the issue of not being able to cancel is so annoying it is beyond belief… especially that the new module is so broken that you end up testing all of it 530403403400 times a day - needed to restart everything each time…

cblackuk on Sep 15, 2019

BTW when problems happen in the broswer you can never cancel the command on the PowerShell window. You should have some time out or ability to cancel the command otherwise I have to close the whole window.

slavizh on Sep 15, 2019