Scope "offline_access" isn't being returned in the token response.

Question

question

VinayRamkrishnan-9531 asked Apr 8, '22 amanpreetsingh-msft edited May 16, '22

Scope "offline_access" isn't being returned in the token response.

Hi,

I am testing an OAuth integration using the OAuth v2.0 endpoints.

In my initial request to oauth2/v2.0/authorize I am sending a request containing the following scopes:
User.Read, offline_access, Files.Read.All

And then for the second token endpoint oauth2/v2.0/token, I pass the code from the authorize step, along with grant_type as authorization_code and the redirect_uri.
The response returned contains the access_token & the refresh_token as expected, but the returned list of scopes doesn't contain offline_access. Is it a bug? or is that expected and just some misunderstanding on my part.

My returned list of scopes is as follows:

 "scope":"Files.Read.All openid User.Read profile email"

~Vinay

azure-ad-authentication

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 1 · 2022-04-11T04:17:22.33Z

amanpreetsingh-msft answered Apr 11, '22 amanpreetsingh-msft edited May 16, '22

Hi @VinayRamkrishnan-9531 • Thank you for reaching out.

This is expected. The offline_access scope is used to request for Refresh Token and is never returned as a scope because it cannot be a part of the access token and cannot be used for scope-based authorizations.

As highlighted below, even when the offline_access scope is specified in the request, it is not returned as a scope:

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

image.png (31.0 KiB)

· 3

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

amanpreetsingh-msft · Apr 12 at 04:55 AM

Hi @VinayRamkrishnan-9531 • Just following up if you have any further questions.

0 ·

VinayRamkrishnan-9531 · May 04 at 10:20 PM

thanks for the response!

I guess that makes sense . The reason its confusing is that --I do see offline_access being returned when I use the v1 endpoints:
https://login.microsoftonline.com/common/oauth2/authorize
https://login.microsoftonline.com/common/oauth2/token

Is that just a bug or is this a change that was implemented in v2

Appreciate your responses here,

~Vinay

0 ·

amanpreetsingh-msft VinayRamkrishnan-9531 · May 10 at 07:40 AM

@VinayRamkrishnan-9531 • I've never seen offline_access being returned as a scope. I tested with the v1 (common) endpoint as well but didn't get it as a scope, as highlighted below. Can you share a screenshot of the request you made to the v1 endpoint and offline_access as a scope in the response?

0 ·

image.png (69.8 KiB)

question