How can I configure the expiration time of an Azure AD access token (using ADAL)?
We use Azure AD to authenticate users into our WPF application, using their Office 365 accounts. This is done using the Active Directory Authentication Library (ADAL).
Currently, they are prompted to log in every time they open the app. We want to change this to allow logging in to the app via a cached token. This works but we want to shorten the expiration time of the token to 24 hours or less, requiring another sign in after that time has passed.
I don't see a way to manipulate the expiration of an Access Token in code. Is this something that needs to be done within Azure AD?
c# oauth-2.0
azure-active-directory access-token adal asked Oct 20 '17 at 15:56
S-VukS-Vuk
89110
add a comment |
We use Azure AD to authenticate users into our WPF application, using their Office 365 accounts. This is done using the Active Directory Authentication Library (ADAL).
Currently, they are prompted to log in every time they open the app. We want to change this to allow logging in to the app via a cached token. This works but we want to shorten the expiration time of the token to 24 hours or less, requiring another sign in after that time has passed.
I don't see a way to manipulate the expiration of an Access Token in code. Is this something that needs to be done within Azure AD?
c# oauth-2.0
azure-active-directory access-token adal asked Oct 20 '17 at 15:56
S-VukS-Vuk
89110
How's your code look like?
– cuongle
Oct 20 '17 at 16:09
add a comment |
We use Azure AD to authenticate users into our WPF application, using their Office 365 accounts. This is done using the Active Directory Authentication Library (ADAL).
Currently, they are prompted to log in every time they open the app. We want to change this to allow logging in to the app via a cached token. This works but we want to shorten the expiration time of the token to 24 hours or less, requiring another sign in after that time has passed.
I don't see a way to manipulate the expiration of an Access Token in code. Is this something that needs to be done within Azure AD?
c# oauth-2.0
azure-active-directory access-token adal asked Oct 20 '17 at 15:56
S-VukS-Vuk
89110
We use Azure AD to authenticate users into our WPF application, using their Office 365 accounts. This is done using the Active Directory Authentication Library (ADAL).
Currently, they are prompted to log in every time they open the app. We want to change this to allow logging in to the app via a cached token. This works but we want to shorten the expiration time of the token to 24 hours or less, requiring another sign in after that time has passed.
I don't see a way to manipulate the expiration of an Access Token in code. Is this something that needs to be done within Azure AD?
c# oauth-2.0
azure-active-directory access-token adal c# oauth-2.0
azure-active-directory access-token adal asked Oct 20 '17 at 15:56
S-VukS-Vuk
89110
asked Oct 20 '17 at 15:56
S-VukS-Vuk
89110
asked Oct 20 '17 at 15:56
S-VukS-Vuk
89110
asked Oct 20 '17 at 15:56
S-VukS-Vuk
89110
asked Oct 20 '17 at 15:56
S-VukS-Vuk
89110
89110
How's your code look like?
– cuongle
Oct 20 '17 at 16:09
add a comment |
How's your code look like?
– cuongle
Oct 20 '17 at 16:09
How's your code look like?
– cuongle
Oct 20 '17 at 16:09
How's your code look like?
– cuongle
Oct 20 '17 at 16:09
add a comment |
1 Answer
1
active
oldest
votes
Summary
You cannot use ADAL to configure the expiration time of tokens. ADAL is an authentication library that helps you interact with the token service, but you can set the token lifetime configuration on your Service Principal, Application, or Tenant.
You'll need to use Powershell to create a policy describing the behavior you want, and link it to your service principal, tenant, or application. Keep in mind, if you're building a multi-tenant app, the owner of the tenant can overwrite your policy.
tl;dr: Don't rely on the token lifetime in your app as it can change at any time.
Ccreate and set Token Lifetime Policy
You can set these properties using Azure AD Powershell Commands. Then run the following commands to set an access token lifetime:
- Sign in to Powershell.
Connect-AzureAD -Confirm
- Create a new policy to set the Access Token lifetime to 2 hours. You can change this to be between 10 minutes and 1 day.
New-AzureADPolicy -Definition @('{"TokenLifetimePolicy":{"Version":1,"AccessTokenLifetime":"02:00:00","MaxAgeSessionSingleFactor":"02:00:00"}}') -DisplayName "WebPolicyScenario" -IsOrganizationDefault $false -Type "TokenLifetimePolicy"
- Get the policys ObjectId.
Get-AzureAdPolicy
- Link the new policy to your application. You can get the objectId of your app using the GraphExplorer.
Add-AzureADApplicationPolicy -Id <ObjectId of the Application> -RefObjectId <ObjectId of the Policy>
For more examples and the full documentation, checkout Azure AD Configurable Token Lifetime.
answered Oct 20 '17 at 16:25
Daniel DobalianDaniel Dobalian
2,3592723
Sounds like exactly what we need. I'll mark this as the answer for now and will comment back if something doesn't work, but I imagine it should. Thanks
– S-Vuk
Oct 20 '17 at 19:13
@S-Vuk let me know if you have any hiccups!
– Daniel Dobalian
Oct 23 '17 at 2:56
@DanielDobalian are you aware of a way to do this without powershell?
– Martin Peck
Mar 1 at 8:18
@MartinPeck these PowerShell scripts call the Azure AD Graph API, so I believe you can do it directly against the API. If you're looking for some UI, I think the Azure AD Graph Explorer will help!
– Daniel Dobalian
2 days ago
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f46852882%2fhow-can-i-configure-the-expiration-time-of-an-azure-ad-access-token-using-adal%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Summary
You cannot use ADAL to configure the expiration time of tokens. ADAL is an authentication library that helps you interact with the token service, but you can set the token lifetime configuration on your Service Principal, Application, or Tenant.
You'll need to use Powershell to create a policy describing the behavior you want, and link it to your service principal, tenant, or application. Keep in mind, if you're building a multi-tenant app, the owner of the tenant can overwrite your policy.
tl;dr: Don't rely on the token lifetime in your app as it can change at any time.
Ccreate and set Token Lifetime Policy
You can set these properties using Azure AD Powershell Commands. Then run the following commands to set an access token lifetime:
- Sign in to Powershell.
Connect-AzureAD -Confirm
- Create a new policy to set the Access Token lifetime to 2 hours. You can change this to be between 10 minutes and 1 day.
New-AzureADPolicy -Definition @('{"TokenLifetimePolicy":{"Version":1,"AccessTokenLifetime":"02:00:00","MaxAgeSessionSingleFactor":"02:00:00"}}') -DisplayName "WebPolicyScenario" -IsOrganizationDefault $false -Type "TokenLifetimePolicy"
- Get the policys ObjectId.
Get-AzureAdPolicy
- Link the new policy to your application. You can get the objectId of your app using the GraphExplorer.
Add-AzureADApplicationPolicy -Id <ObjectId of the Application> -RefObjectId <ObjectId of the Policy>
For more examples and the full documentation, checkout Azure AD Configurable Token Lifetime.
answered Oct 20 '17 at 16:25
Daniel DobalianDaniel Dobalian
2,3592723
Sounds like exactly what we need. I'll mark this as the answer for now and will comment back if something doesn't work, but I imagine it should. Thanks
– S-Vuk
Oct 20 '17 at 19:13
@S-Vuk let me know if you have any hiccups!
– Daniel Dobalian
Oct 23 '17 at 2:56
@DanielDobalian are you aware of a way to do this without powershell?
– Martin Peck
Mar 1 at 8:18
@MartinPeck these PowerShell scripts call the Azure AD Graph API, so I believe you can do it directly against the API. If you're looking for some UI, I think the Azure AD Graph Explorer will help!
– Daniel Dobalian
2 days ago
add a comment |
Summary
You cannot use ADAL to configure the expiration time of tokens. ADAL is an authentication library that helps you interact with the token service, but you can set the token lifetime configuration on your Service Principal, Application, or Tenant.
You'll need to use Powershell to create a policy describing the behavior you want, and link it to your service principal, tenant, or application. Keep in mind, if you're building a multi-tenant app, the owner of the tenant can overwrite your policy.
tl;dr: Don't rely on the token lifetime in your app as it can change at any time.
Ccreate and set Token Lifetime Policy
You can set these properties using Azure AD Powershell Commands. Then run the following commands to set an access token lifetime:
- Sign in to Powershell.
Connect-AzureAD -Confirm
- Create a new policy to set the Access Token lifetime to 2 hours. You can change this to be between 10 minutes and 1 day.
New-AzureADPolicy -Definition @('{"TokenLifetimePolicy":{"Version":1,"AccessTokenLifetime":"02:00:00","MaxAgeSessionSingleFactor":"02:00:00"}}') -DisplayName "WebPolicyScenario" -IsOrganizationDefault $false -Type "TokenLifetimePolicy"
- Get the policys ObjectId.
Get-AzureAdPolicy
- Link the new policy to your application. You can get the objectId of your app using the GraphExplorer.
Add-AzureADApplicationPolicy -Id <ObjectId of the Application> -RefObjectId <ObjectId of the Policy>
For more examples and the full documentation, checkout Azure AD Configurable Token Lifetime.
answered Oct 20 '17 at 16:25
Daniel DobalianDaniel Dobalian
2,3592723
Sounds like exactly what we need. I'll mark this as the answer for now and will comment back if something doesn't work, but I imagine it should. Thanks
– S-Vuk
Oct 20 '17 at 19:13
@S-Vuk let me know if you have any hiccups!
– Daniel Dobalian
Oct 23 '17 at 2:56
@DanielDobalian are you aware of a way to do this without powershell?
– Martin Peck
Mar 1 at 8:18
@MartinPeck these PowerShell scripts call the Azure AD Graph API, so I believe you can do it directly against the API. If you're looking for some UI, I think the Azure AD Graph Explorer will help!
– Daniel Dobalian
2 days ago
add a comment |
Summary
You cannot use ADAL to configure the expiration time of tokens. ADAL is an authentication library that helps you interact with the token service, but you can set the token lifetime configuration on your Service Principal, Application, or Tenant.
You'll need to use Powershell to create a policy describing the behavior you want, and link it to your service principal, tenant, or application. Keep in mind, if you're building a multi-tenant app, the owner of the tenant can overwrite your policy.
tl;dr: Don't rely on the token lifetime in your app as it can change at any time.
Ccreate and set Token Lifetime Policy
You can set these properties using Azure AD Powershell Commands. Then run the following commands to set an access token lifetime:
- Sign in to Powershell.
Connect-AzureAD -Confirm
- Create a new policy to set the Access Token lifetime to 2 hours. You can change this to be between 10 minutes and 1 day.
New-AzureADPolicy -Definition @('{"TokenLifetimePolicy":{"Version":1,"AccessTokenLifetime":"02:00:00","MaxAgeSessionSingleFactor":"02:00:00"}}') -DisplayName "WebPolicyScenario" -IsOrganizationDefault $false -Type "TokenLifetimePolicy"
- Get the policys ObjectId.
Get-AzureAdPolicy
- Link the new policy to your application. You can get the objectId of your app using the GraphExplorer.
Add-AzureADApplicationPolicy -Id <ObjectId of the Application> -RefObjectId <ObjectId of the Policy>
For more examples and the full documentation, checkout Azure AD Configurable Token Lifetime.
answered Oct 20 '17 at 16:25
Daniel DobalianDaniel Dobalian
2,3592723
Summary
You cannot use ADAL to configure the expiration time of tokens. ADAL is an authentication library that helps you interact with the token service, but you can set the token lifetime configuration on your Service Principal, Application, or Tenant.
You'll need to use Powershell to create a policy describing the behavior you want, and link it to your service principal, tenant, or application. Keep in mind, if you're building a multi-tenant app, the owner of the tenant can overwrite your policy.
tl;dr: Don't rely on the token lifetime in your app as it can change at any time.
Ccreate and set Token Lifetime Policy
You can set these properties using Azure AD Powershell Commands. Then run the following commands to set an access token lifetime:
- Sign in to Powershell.
Connect-AzureAD -Confirm
- Create a new policy to set the Access Token lifetime to 2 hours. You can change this to be between 10 minutes and 1 day.
New-AzureADPolicy -Definition @('{"TokenLifetimePolicy":{"Version":1,"AccessTokenLifetime":"02:00:00","MaxAgeSessionSingleFactor":"02:00:00"}}') -DisplayName "WebPolicyScenario" -IsOrganizationDefault $false -Type "TokenLifetimePolicy"
- Get the policys ObjectId.
Get-AzureAdPolicy
- Link the new policy to your application. You can get the objectId of your app using the GraphExplorer.
Add-AzureADApplicationPolicy -Id <ObjectId of the Application> -RefObjectId <ObjectId of the Policy>
For more examples and the full documentation, checkout Azure AD Configurable Token Lifetime.
answered Oct 20 '17 at 16:25
Daniel DobalianDaniel Dobalian
2,3592723
answered Oct 20 '17 at 16:25
Daniel DobalianDaniel Dobalian
2,3592723
answered Oct 20 '17 at 16:25
Daniel DobalianDaniel Dobalian
2,3592723
answered Oct 20 '17 at 16:25
Daniel DobalianDaniel Dobalian
2,3592723
2,3592723
Sounds like exactly what we need. I'll mark this as the answer for now and will comment back if something doesn't work, but I imagine it should. Thanks
– S-Vuk
Oct 20 '17 at 19:13
@S-Vuk let me know if you have any hiccups!
– Daniel Dobalian
Oct 23 '17 at 2:56
@DanielDobalian are you aware of a way to do this without powershell?
– Martin Peck
Mar 1 at 8:18
@MartinPeck these PowerShell scripts call the Azure AD Graph API, so I believe you can do it directly against the API. If you're looking for some UI, I think the Azure AD Graph Explorer will help!
– Daniel Dobalian
2 days ago
add a comment |
Sounds like exactly what we need. I'll mark this as the answer for now and will comment back if something doesn't work, but I imagine it should. Thanks
– S-Vuk
Oct 20 '17 at 19:13
@S-Vuk let me know if you have any hiccups!
– Daniel Dobalian
Oct 23 '17 at 2:56
@DanielDobalian are you aware of a way to do this without powershell?
– Martin Peck
Mar 1 at 8:18
@MartinPeck these PowerShell scripts call the Azure AD Graph API, so I believe you can do it directly against the API. If you're looking for some UI, I think the Azure AD Graph Explorer will help!
– Daniel Dobalian
2 days ago
Sounds like exactly what we need. I'll mark this as the answer for now and will comment back if something doesn't work, but I imagine it should. Thanks
– S-Vuk
Oct 20 '17 at 19:13
Sounds like exactly what we need. I'll mark this as the answer for now and will comment back if something doesn't work, but I imagine it should. Thanks
– S-Vuk
Oct 20 '17 at 19:13
@S-Vuk let me know if you have any hiccups!
– Daniel Dobalian
Oct 23 '17 at 2:56
@S-Vuk let me know if you have any hiccups!
– Daniel Dobalian
Oct 23 '17 at 2:56
@DanielDobalian are you aware of a way to do this without powershell?
– Martin Peck
Mar 1 at 8:18
@DanielDobalian are you aware of a way to do this without powershell?
– Martin Peck
Mar 1 at 8:18
@MartinPeck these PowerShell scripts call the Azure AD Graph API, so I believe you can do it directly against the API. If you're looking for some UI, I think the Azure AD Graph Explorer will help!
– Daniel Dobalian
2 days ago
@MartinPeck these PowerShell scripts call the Azure AD Graph API, so I believe you can do it directly against the API. If you're looking for some UI, I think the Azure AD Graph Explorer will help!
– Daniel Dobalian
2 days ago
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f46852882%2fhow-can-i-configure-the-expiration-time-of-an-azure-ad-access-token-using-adal%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
How's your code look like?
– cuongle
Oct 20 '17 at 16:09