Azure AD Provider - No refresh_token on account (JWT callback) - Solved

[jacomonh]

I am using the new Azure AD provider.
I tried implementing the Refresh Token as specified in the Next-Auth website: https://next-auth.js.org/tutorials/refresh-token-rotation.
However, the object that I recieved as account did not contain the refresh_token.

JWT Callback -> account:

{
  provider: 'azure-ad',
  type: 'oauth',
  providerAccountId: '...',
  token_type: 'Bearer',
  scope: 'Calendars.Read email openid People.Read profile User.Read User.Read.All User.ReadBasic.All User.ReadWrite',
  expires_at: 1638633607,
  ext_expires_in: 3978,
  access_token: '...
}

What can be done?

[balazsorban44]

it means that your provider does not support refresh tokens then. Or that maybe you have to configure it somewhere to be returned.

[jacomonh]

It actually does support refresh tokens: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow#refresh-the-access-token
About the configuration, I cant seem to find anything in the documentation regarding OAuth in Next-Auth.

[balazsorban44]

I meant of Azure. we just forward anything sent by your provider. you don't need to configure anything on the NextAuth.js side

[jacomonh]

I figured it out.
I had to add to the scope of the authorization the following:

authorization:{ params:{ scope: 'User.Read User.Read.All https://ads.microsoft.com/msads.manage offline_access', } }

[jacomonh]

Guys, in case anyone is wandering the easiest way to make it work, I figured it out.

Inside the provider, just add this to the scope:

providers: [
    AzureADProvider({
      clientId: process.env.AZURE_AD_CLIENT_ID,
      clientSecret: process.env.AZURE_AD_CLIENT_SECRET,
      tenantId: process.env.AZURE_AD_TENANT_ID,
      authorization:{
            params:{
                  scope: 'User.Read User.Read.All https://ads.microsoft.com/msads.manage offline_access',
            }
      }
}),