Contents
What happens when a Microsoft access token expires?
When the access token expires, the client must use the refresh token to (usually silently) acquire a new refresh token and access token. You can adjust the lifetime of an access token to control how often the client application expires the application session, and how often it requires the user to re-authenticate (either silently or interactively).
Can a resource accept a Microsoft identity token?
Resources accept the token. The Microsoft identity platform supports issuing any token version from any version endpoint – they are not related. This is why a resource setting accessTokenAcceptedVersion to 2 means that a client calling the v1.0 endpoint to get a token for that API will receive a v2.0 access token.
Which is the application ID of the client using the token?
The application ID of the client using the token. The application can act as itself or on behalf of a user. The application ID typically represents an application object, but it can also represent a service principal object in Azure AD. Only present in v2.0 tokens, a replacement for appid. The application ID of the client using the token.
What does AUD mean in Microsoft identity token?
The aud claim in a token indicates the resource the token is intended for (its audience ). Clients use the token but should not understand or attempt to parse it. Resources accept the token. The Microsoft identity platform supports issuing any token version from any version endpoint – they are not related.
How are lifetimes of tokens defined in Microsoft identity platform?
Token lifetime policies for refresh tokens and session tokens 1 Refresh tokens. When a client acquires an access token to access a protected resource, the client also receives a refresh token. 2 Single sign-on session tokens. 3 Refresh and session token lifetime policy properties. 4 Configurable policy property details.
How long does a nonpersistent session token last?
Usually, a nonpersistent session token is stored. But, when the user selects the Keep me signed in check box during authentication, a persistent session token is stored. Nonpersistent session tokens have a lifetime of 24 hours. Persistent tokens have a lifetime of 90 days.
How is session timeout controlled in apex token?
Session timeout is controlled by the connected app that you used to get the token. If you don’t set the timeout in the connected app, then it defaults to the timout set in the org-wide session settings. Thanks for contributing an answer to Salesforce Stack Exchange!