Hi Paul.

Thanks for your help. I'm trying the equivalent for members, but getting nothing here:

var me = _memberService.GetById(int.Parse(User.Identity.GetUserId()));
var myTokens = _externalLogins.GetExternalLoginTokens(me.Key);

'myTokens' is null.

I'm not sure if this is Members vs Users thing, or it's something specific to Azure AD.

I noticed in the Umbraco external login examples for Azure AD, there is a 'options.SaveTokens = true'. This throws an NotImplemented exception if I set this to true, however. Might be a red herring, but it sounds related.. the Umbraco source makes it looks it's been omitted by design, but I can't think why..

If you're interested the rc for 9.4 is out and this should hopefully work there if you're up for being a tester.

https://www.nuget.org/packages/Umbraco.Cms/9.4.0-rc

Hi Paul,

Thanks for adding that fix! Adding 'saveTokens = true' no longer throws an exception. I think I'm still doing something wrong, however.

_externalLogins.GetExternalLoginTokens(me.Key);

is now an empty list rather than null. The 'umbracoExternalLoginToken' table is empty in the db.

Here's my config:

public static class MicrosoftMemberAuthenticationExtensions
{
    public static IUmbracoBuilder AddMicrosoftB2CMemberAuthentication(this IUmbracoBuilder builder)
    {
        builder.Services.ConfigureOptions<MicrosoftB2CMemberExternalLoginProviderOptions>();

        builder.AddMemberExternalLogins(logins =>
        {
            logins.AddMemberLogin(
                memberAuthenticationBuilder =>
                {
                    memberAuthenticationBuilder.AddOpenIdConnect(
                        // The scheme must be set with this method to work for the back office
                        memberAuthenticationBuilder.SchemeForMembers(MicrosoftB2CMemberExternalLoginProviderOptions.SchemeName),
                        options =>
                        {
                            options.Events = new OpenIdConnectEvents
                            {
                                OnTokenValidated = context =>
                                {
                                    //Mapping 'emails' to the required 'email'
                                    var claimsIdentity = (ClaimsIdentity)context.Principal.Identity;
                                    claimsIdentity.AddClaim(new Claim("email", context.Principal.FindFirst("emails").Value));
                                    return Task.FromResult(0);
                                }
                            };

                            // use cookies
                            options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;

                            // pass configured options along
                            options.Authority = "xxxxxxxxxxxxxx";
                            options.ClientId = "xxxxxxxxxxxxxx";
                            options.ClientSecret = "xxxxxxxxxxxxxx";
                            options.CallbackPath = "/signin-oidc";

                            options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
                            {
                                ValidateIssuer = false,
                                SaveSigninToken = true
                            };

                            // Use the authorization code flow
                            options.ResponseType = OpenIdConnectResponseType.Code;
                            options.AuthenticationMethod = OpenIdConnectRedirectBehavior.RedirectGet;

                            options.RequireHttpsMetadata = true;
                            options.GetClaimsFromUserInfoEndpoint = true;

                            options.Scope.Add("xxxxxxxxxxxxxx");
                            options.UsePkce = true;

                            options.SaveTokens = true;  //now allowed in 9.4
                        });
                });
        });
        return builder;
    }
}

Logging in and autolinking works perfectly still.. It's just the retrieval of the external login token afterwards that's still alluding me. Any ideas?

Thanks

Ah - ignore me. It's working (sort of!) if I removed all the members pre-9.4 then re-registered.

The issue I'm having now is that the 'access token' only gets set on the INITIAL auto-link of the member. Any access token used to login subsequently is not getting saved into the 'umbracoExternalLoginTokens' table. I'm not sure if there is a setting I'd need to change somewhere, or if this a bug. Paul - I don't have a 'refresh token' at all, like you do in your screenshot - not sure if that's something to do with it.

Is there a mechanism for manually refreshing access tokens built into Umbraco's external login providers?

You won't get a refresh token unless the scope offline_access is requested.

Once you have that you should be able to exchange the refresh token for a new access token.