Azure AD OAth TOKEN refresh automatically or with code

John Daly · ‎06-07-2021

I am using the Microsoft Azure AD spoke within Flow Designer. I set up OAuth credentials using the information at the following URL: https://docs.servicenow.com/bundle/quebec-servicenow-platform/page/administer/integrationhub-store-spokes/task/set-up-azure.html#configure-azure-ad-account) I set this up in our Lower env. I used "Application Registry" entry "Azure AD OAuth DEV" on the oauth_entity table. I used credential "Azure AD Credentials DEV" on the discovery_credentials table I used "Connection and Credential" alias "AzureAD" on the sys_alias table I am able to get a token using the "Get OAuth Token" link on the credential page. This token is good for 1-hour. My problem is, when this token expires, I have to manually go back to the credential page and click the link again. I need a way to automatically refresh this token, or to be able to do it with scripting. I would love to have an activity in Flow Designer That I could call to get a new token before making my call out to Azure AD. Or maybe renew it on a 1/2 hour schedule. Not sure what the best way would be, but I know I cannot manually refresh it. It seems as though there has to be a way to do this but I have not figured it out yet. How can this be used where I do not have to manually refresh a TOKEN to get connected to Azure AD? Can someone with OAuth knowledge please assist me, or point me to some information I can use to set this up? I need to get this working.

John Daly · ‎06-11-2021

I found the solution to the problem I was having.

The problem is that the ServiceNow Product documentation at the following URL that I used to set up the OAuth configuration in ServiceNow for Azure AD was missing a piece of information:

https://docs.servicenow.com/bundle/quebec-servicenow-platform/page/administer/integrationhub-store-s...

If you look at section "Register Azure AD as OAuth provider" and then look at step 8, it originally said the following:

"Verify that the openid entity scope record created in previous steps appears in the OAuth Entity Profile Scopes related list. If it does not appear, add the record."

What it should say is:

"Verify that the openid entity scope AND offline_access entity scope records created in previous steps appears in the OAuth Entity Profile Scopes related list. If they do not appear, add the records."

It is the offline_access entity scope that requests that a refresh token is sent back from Azure AD and this refresh token will then appear in the oauth_credential table.

Once I had this set correctly and was getting the refresh token, everything worked as I expected.

View solution in original post

Jeffrey Barton · ‎10-20-2023

I can't seem to find the Utah version of this doc and the links won't let me view the quebec so can someone find the correct article again? This is happening on my instance in Utah and I need to review the article. Thanks.

Nabil EL FILALI · ‎09-28-2024

Hello john

Thank you for your constructive post , but in my case , i'm already having under 'OAuth Entity Scopes' , the 'offline_access' . are you using 'Client Credentails" for Grant Type ?

Thank you again