2

I have a web app which utlizes Oauth and is unable to reuse the authToken due to the error below.

{"AADSTS70002: Error validating credentials. AADSTS54005: OAuth2 Authorization 
code was already redeemed, please retry with a new valid code or use an 
existing refresh token.\r\nTrace ID: 30c342a7-f16a-4a05-a4a8- 
c7ee2c722300\r\nCorrelation ID: 3a5c99d1-ca1c-4cd7-bd36- 
cce721bf05b6\r\nTimestamp: 2018-11-21 00:26:18Z"}

I'm told this is a know issue/update here and here. ...okay, fine so now I'm trying to get the refresh token so I can regenerate my access token but I'm having trouble getting something to work.

I have tried the ones below: https://learn.microsoft.com/en-us/bingads/shopping-content/code-example-authentication-oauth - this one does not seem to work and throws an exception when I try to get the accesstoken or refresh token. stating that one or more errors have occured.

https://auth0.com/docs/api/authentication#authorization-code-pkce- - but does not return the refresh token. Could this be because I don't have the code_verifier? If so, how would I get that?

Authorization Code (PKCE) Image

Below is a code sample which I am using - problem here is that I can only use this once and once It has been redemed I cannot retrive it silently as it no longer exists in the cache.

ClientCredential clientcred = new ClientCredential(Constants.ClientId, Constants.AppKey);

 TokenCache TC = new TokenCache();

 AuthenticationContext AC = new AuthenticationContext(Constants.Authority, TC);
 //Set token from authentication result
 AuthenticationResult authenticationResult = await AC.AcquireTokenByAuthorizationCodeAsync(
            Constants.Code,
 new Uri(Constants.postLogoutRedirectUri + "Index"), clientcred);

 return authenticationResult.AccessToken;
2
  • what auth server are you connecting to? Nov 30, 2018 at 11:05
  • Did you find the fix for this? I have same issue.
    – PNDev
    Jan 31, 2019 at 7:21

1 Answer 1

0

You need to call OAuth2 authorize endpoint with offline_access scope to get refresh token.

You should call AcquireTokenByAuthorizationCodeAsync only once when you receive authorization code and should not use the result. azure ad sample

You need to call AcquireTokenSilently when you want to get access token. azure ad sample

This azure ad sample use a TokenCache implementation by user id.

Authorize request Authorize request

Token request Token request

Good luck!

2
  • Your token screenshot looks just like the screenshot I had linked in my description. I’m am however, missing the reply uri. Is that the difference between getting the refresh token and not getting it? Dec 2, 2018 at 2:33
  • The offline_access into authorize request. Dec 2, 2018 at 13:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.