A common case is using AzureAD via OpenIdConnect for login and then wanting to consume GraphAPI services.

In order to consume GraphAPI, you will need a short-lived Access_token.

To get a fresh Access_token, you will need a Refresh_token.

To get the Refresh_token, you must make a call to the token-endpoint with the short-lived code you get when you log in.

Turnkey will do all this for you and update the SysUserClaim object with a ClaimType of access_token and refresh_token.

These will be fetched when you log in.

The access_token is short-lived; you should renew it prior to new operations.

Turnkey can renew it if you add and later call a Method on SysUser:

OpenIdConnectAccessTokenRefresh():String (TV: Eco.ExternalLateBound) 

This will return an error or ok. If it is ok, the SysUserClaim object with a ClaimType of access_token and refresh_token has been updated.

For this to work, you need to supply settings for OpenIdConnect.

• (You must give the OpenID_TokenEndPoint, and OpenIDConnectScope must contain offline_access for AzureAD to issue refresh_token)
• You should also set a value on SharedSecret in TurnkeySettings - this will be used to encrypt the temporary tokens stored in the db