RedeemRefreshToken UserJourney throws AADB2C90085

[michiproep]

I have updated my policy as suggested in the readme regarding to new refresh token journey. I did upload my files successfully, I can get a refresh token via auth_code flow but as soon as I call the token endpoint with grant_type refresh_token I end up with { "error": "invalid_grant", "error_description": "AADB2C90085: The service has encountered an internal error. Please reauthenticate and try again.\r\nCorrelation ID: 187ac3ca-a228-4a22-bc60-baf70b904174\r\nTimestamp: 2022-09-29 15:34:23Z\r\n" }

As soon as I remove the <Endpoint Id="Token"...> part, I can get new token via refresh_token.

1. Is there a way to debug that? Because AppInsights doen't show anything about the new journey.
2. Also, what is the difference between this new way of doing RefreshTokensJourney (via "Endpoint") in comparison to that metaData key in the JwtIssuer technical profile (RefreshTokenUserJourneyId) ?
3. Does "Endpoint Id="Token"" also affect clientcredentials flow or auth_code flow since they all use the tokenendpoint?

[michiproep]

Update: I could make it work - basically! Since I did extend the TP AAD-UserReadUsingObjectId, I was missing an OutputClaim in TP RefreshTokenReadAndSetup.

But there are still a lot of questions:

1. What exactly gets extracted from the refreshToken and how does it relate to "PreserveOriginalAssertion"?
2. Are "real" ClaimTypes used within the token or PartnerClaimTypes?
3. There should be some documentation on how things work in detail

[elKei24]

I totally agree that the topic of refresh tokens lacks a lot of documentation. In case someone stumbles across this issue while looking for some explanations like I did, I can at least provide the answer for 2. now.

The refresh token contains the same PartnerClaimTypes as the access token. They need to be mapped back to the "real" claim types when extracting them from the refresh token. The example should probably rather look something like this:

<OutputClaim ClaimTypeReferenceId="RESTAPIclaim1" PartnerClaimType="claim-1" />
<OutputClaim ClaimTypeReferenceId="IDPclaim2" PartnerClaimType="claim-2" />