使用 AAD 进行身份验证的 Azure App 在一段时间后返回 401

Question

I have a C# .net core web app hosted on Azure App Services. It is using Azure Active Directory for authentication.

The authentication is working - when users access the web app they are asked to login and once they do they can access the web app successfully.

However, sometime after visiting the web app and returning to the web app they will sometimes receive a 401 error. I think in particular it happens if the users browser has been open a long time between visits. The web app is being used in a business environment and it is common for users to go days between closing their browser (at the end of the day the user will typically just close their laptop rather than shutting it down).

If I delete the users AppServiceAuthSession session cookie they can successfully access the webapp itself so it seems that the cookie is maybe expiring but not refreshing itself.

Is there anything that can be done to stop the user receiving a 401 error - it would be preferrable that the web app deletes and recreates the session cookie and asks the user to login again if needed, or something along those lines.

Answer 1

When azure app service is enabled with identity provider following permissions openid, profile, and email are requested by default.

But when user actually approves offline_access scope is when your app can extend the token life time as your app receives refresh token and gives new access token as the old token expires.

So one needs to explicitly set the offline_access scope in the portal or through authsettingsv2 in resource graph https://resources.azure.com/ , subscriptions >your subscription> > resourceGroups > <your resource group name> > providers > Microsoft.Web > sites > <app_name> > config > authsettingsV2.. and add offline_access in scope list.

identityProviders": {
  "azureActiveDirectory": {
    "login": {
      "loginParameters": ["scope=openid profile email offline_access"]
    }
  }
}

To refresh the access token, call /.auth/refresh at any time in your app. When the authentication session expires after ~8 hrs, there will be a grace period upto 72 hrs to refresh it.So call /.auth/refresh when token becomes invalid so that the user need not track every time until 72hrs is finished and session token expires. After that 72hrs user need to authenticate again.

Even this grace period can be extended if required to some (short value) mostly using azure cli. Please check this OAuth tokens in AuthN/AuthZ - Azure App Service |Microsoft Learn

az webapp auth update --resource-group <group_name> --name <app_name> --token-refresh-extension-hours <hours>

I have not extended value and can see from below command

az webapp auth show --resource-group <group_name> --name <app_name> --token-refresh-extension-hours <hours>