Azure Devops extension : refresh token for service endpoint with oauth2 - azure

Question

I'm currently building an extension and i added a service endpoint used to fetch some information from our server.
Our server uses Azure AD to authenticate, i successfully Authorize the service connection in DevOps and the information are correctly fetched. However the token used expires at some point and i would like to know how i could refresh it.
The documentation about this feature is kinda lacking and i'm a bit lost
here is the manifest json :
{
"id": "service-endpoint",
"description": "Service endpoint to get game information",
"type": "ms.vss-endpoint.service-endpoint-type",
"targets": [ "ms.vss-endpoint.endpoint-types" ],
"properties": {
"name": "portal",
"displayName": "Portal Access",
"dataSources": [
{
"name": "AccessToken",
"endpointUrl": "{{{configuration.Url}}}/token",
"requestVerb": "Post",
"requestContent": "grant_type=authorization_code&code={{{#uriDataEncode 1 AuthorizationCode}}}{{{/uridataencode}}}&client_id={{{#uriDataEncode 1 configuration.ClientId}}}{{{/uridataencode}}}&client_secret={{{#uriDataEncode 1 configuration.ClientSecret}}}{{{/uridataencode}}}&redirect_uri={{{#uriDataEncode 1 RedirectUrl}}}{{{/uridataencode}}}",
"resultSelector": "jsonpath:$",
"headers": [
{
"name": "Content-Type",
"value": "application/x-www-form-urlencoded"
}
]
},
{
"name": "Game",
"endpointUrl": "{{{endpoint.url}}}/Studio/studios/games",
"requestVerb": "Get",
"resultSelector": "jsonpath:$.[*]",
"headers": [
{
"name": "Content-Type",
"value": "application/json"
}
]
},
{
"name": "RefreshToken",
"endpointUrl": "{{{configuration.Url}}}/token",
"requestVerb": "Post",
"requestContent": "grant_type=refresh_token&refresh_token={{{#uriDataEncode 1 RefreshToken}}}{{{/uridataencode}}}&client_id={{{#uriDataEncode 1 configuration.ClientId}}}{{{/uridataencode}}}&client_secret={{{#uriDataEncode 1 configuration.ClientSecret}}}{{{/uridataencode}}}",
"resultSelector": "jsonpath:$",
"headers": [
{
"name": "Content-Type",
"value": "application/x-www-form-urlencoded"
}
]
}
],
"authenticationSchemes": [
{
"displayName": "i18n:OAuth2",
"type": "ms.vss-endpoint.endpoint-auth-scheme-oauth2",
"headers": [
{
"name": "Authorization",
"value": "Bearer {{{endpoint.AccessToken}}}"
}
],
"authorizationUrl": "{{{configuration.Url}}}/authorize?client_id={{{configuration.ClientId}}}&response_type=code&redirect_uri={{{RedirectUrl}}}&scope=api://03105a38-d4dd-4fa1-8d6a-d1ef5c918574/API.Access",
"dataSourceBindings": [
{
"target": "AccessToken",
"dataSourceName": "AccessToken",
"resultTemplate": "{\"AccessToken\" : \"{{{access_token}}}\", \"RefreshToken\" : \"{{{refresh_token}}}\", \"ExpiresIn\" : \"{{{expires_in}}}\", \"TokenType\" : \"{{{token_type}}}\", \"Scope\" : \"{{{scope}}}\", \"Error\" : \"{{{error}}}\", \"ErrorDescription\" : \"{{{error_description}}}\"}"
},
{
"target": "RefreshToken",
"dataSourceName": "RefreshToken",
"resultTemplate": "{\"AccessToken\" : \"{{{access_token}}}\", \"RefreshToken\" : \"{{{refresh_token}}}\", \"ExpiresIn\" : \"{{{expires_in}}}\", \"TokenType\" : \"{{{token_type}}}\", \"Scope\" : \"{{{scope}}}\", \"Error\" : \"{{{error}}}\", \"ErrorDescription\" : \"{{{error_description}}}\"}"
}
]
}
],
"helpMarkDown": ""
Thanks in advance !

Answer 1

I tried to reproduce the same in my environment and got the below results:
Note that, to get the refresh token add the offline_access API permission:
I generated access token by using below parameters:
GET
https://login.microsoftonline.com/TenantID/oauth2/v2.0/token
client_id:client_id
grant_type:authorization_code
code:code
redirect_uri:redirect_uri
code_verifier:S256
scope:499b84ac-1321-427f-aa17-267ca6975798/user_impersonation offline_access
client_secret:client_secret
Response:
To refresh the access token, use the below parameters:
GET
https://login.microsoftonline.com/TenantID/oauth2/v2.0/token
client_id:client_id
grant_type:refresh_token
scope:scope
client_secret:client_secret
refresh_token:refreshtoken
Access token will be refreshed successfully like below: