Hello BallSportsGear@Hefin Jones,

It seems that there is no out of the box Umbraco/Microsoft functionality to refresh the access token using the refresh token for external login providers. You may need to implement this manually, as you suggested, by using the IExternalLoginWithKeyService to get the refresh tokens and then calling the Microsoft identity platform endpoint to obtain a new access token and refresh token pair. You can then store the new tokens in the umbracoExternalLoginToken table and use them for your Graph API calls.

Alternatively, you can try to use the Easy Auth feature of Azure App Service, which can automatically refresh the access tokens for you and expose them as environment variables or HTTP headers. However, this may require some additional configuration and changes to your Umbraco site.

I hope this helps you find a solution for your scenario.

Hi,

Thanks for your advice. I have looked into easy auth and implemented it for Umbraco Member login.

While I can login fine, I am unable to get a token using either the ITokenAcquisition service, or with GraphServiceClient based on this URL: https://learn.microsoft.com/en-us/azure/app-service/scenario-secure-app-access-microsoft-graph-as-user?source=recommendations&tabs=azure-resource-explorer

Here is the code for setup:

builder.AddMemberExternalLogins(logins =>
  {
      logins.AddMemberLogin(memberAuthenticationBuilder =>
      {
          memberAuthenticationBuilder
                  .AddMicrosoftIdentityWebApp(options =>
                  {
                      var tenantId = "";
                      var clientId = "";
                      var instance = "https://login.microsoftonline.com/";
                      options.CallbackPath = "/signin-oidc";
                      options.Instance = instance;
                      options.TenantId = tenantId;
                      options.ClientId = clientId;
                      options.SignedOutRedirectUri = "/";
                      options.ClientSecret = "";
                      options.SaveTokens = true;
                      options.Events.OnTokenValidated = ctx =>
                      {
                          var username = ctx.Principal?.Claims.FirstOrDefault(c => c.Type == ClaimConstants.PreferredUserName);
                          if (username != null && ctx.Principal?.Identity is ClaimsIdentity claimsIdentity)
                          {
                              claimsIdentity.AddClaim(
                                  new Claim(
                                      ClaimTypes.Email,
                                      username.Value
                                  )
                              );
                          }

                          return Task.CompletedTask;
                      };
                  }, null, 
                  memberAuthenticationBuilder.SchemeForMembers(SchemeName))
                  .EnableTokenAcquisitionToCallDownstreamApi(initialScopes)
                  .AddInMemoryTokenCaches()
                  .AddMicrosoftGraph(defaultScopes: defaultScopes);

Using the ITokenAcquisition service throws an error of 'ErrorCode: user_null':

var token = await _tokenAcquisition.GetAccessTokenForUserAsync(scopes);

While using HttpContext returns null:

var token = await HttpContext.GetTokenAsync("access_token");

is working on a reply...