Invalid_grant error while trying to request a token using refresh_token

Amar 26 Reputation points
2020-12-10T03:08:06.443+00:00

Hello there, I am using b2c login. I am able to get access_token, first requesting a code via the authorize and then using the code in /token endpoint. The issue is that I get
{"error":"invalid_grant","error_description":"AADB2C90085: The service has encountered an internal error. Please reauthenticate and try again.\r\nCorrelation ID: 9034811c-6025-4e86-947d-fa6911c2c2c4\r\nTimestamp: 2020-12-10 01:30:47Z\r\n"}
Any idea what might be the issue? I have supplied all the necessary parameters like policy, client_id, client_secret, grand_type (which is refresh_token), refresh_token and scope. I tried to find the details about the issue using the correlation ID, but I don't get any record when I run Get-AzureRmLog -CorrelationId "9034811c-6025-4e86-947d-fa6911c2c2c4"

Microsoft Security | Microsoft Entra | Microsoft Entra External ID
0 comments
Answer accepted by question author
AmanpreetSingh-MSFT 56,381 Reputation points Moderator
2020-12-10T06:52:35.26+00:00

Hi Amar-6172 · Welcome to Q&A platform and thanks for your query.

In your Base file, please define ClaimType ID refreshTokenIssuedOnDateTime and add it to TpEngine_RefreshToken as shown below: 

      <ClaimType Id="refreshTokenIssuedOnDateTime">  
        <DisplayName>Refresh Token Issued On Date Time</DisplayName>  
        <DataType>string</DataType>  
      </ClaimType>          
		  
		<TechnicalProfile Id="TpEngine_RefreshToken">  
          <DisplayName>Trust Framework Policy Engine Token Refresh</DisplayName>  
          <Protocol Name="None" />  
          <OutputClaims>  
            <OutputClaim ClaimTypeReferenceId="objectId" />  
            <OutputClaim ClaimTypeReferenceId="refreshTokenIssuedOnDateTime" />  
          </OutputClaims>  
        </TechnicalProfile>

Please refer to this base file for more details and look for refreshTokensValidFromDateTime in this file as well.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Was this answer helpful?

3 people found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Michael 1 Reputation point
    2022-09-29T11:19:48.943+00:00

    May I reopen this issue? @AmanpreetSingh-MSFT
    I updated my policies according to release notes from 09 August 2022 (starter pack).

    I'm able to get all tokens via auth code flow. But using the refresh token (grant_type refresh_token) in ends up with AADB2C90085.

    1. Is there a way to debug this?
    2. What is the difference in using relyingParty->endpoint id=token VS TechnicalProfile JwtIssuer metadata RefreshTokenUserJourneyId ?

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.