Refresh token OpenIddict in Asp Core 1.0 - asp.net

Question

I'd like to add refresh token functionnality in my API, so when a user in y application call the API, if its token is still valid, it will be refresh.
I added the authorizationController, here is the code :
[HttpPost("~/connect/token"), Produces("application/json")]
public IActionResult Exchange(OpenIdConnectRequest request)
{
if (request.IsPasswordGrantType())
{
// Validate the user credentials.
// Note: to mitigate brute force attacks, you SHOULD strongly consider
// applying a key derivation function like PBKDF2 to slow down
// the password validation process. You SHOULD also consider
// using a time-constant comparer to prevent timing attacks.
User user = new Models.User();
using (var db = new UserContext())
{
user = db.User.Where(u => u.login == request.Username).FirstOrDefault();
if (request.Username != user.login || request.Password != user.pwd)
{
return Forbid(OpenIdConnectServerDefaults.AuthenticationScheme);
}
}
// Create a new ClaimsIdentity holding the user identity.
var identity = new ClaimsIdentity(
OpenIdConnectServerDefaults.AuthenticationScheme,
OpenIdConnectConstants.Claims.Name,
OpenIdConnectConstants.Claims.Role);
// Add a "sub" claim containing the user identifier, and attach
// the "access_token" destination to allow OpenIddict to store it
// in the access token, so it can be retrieved from your controllers.
identity.AddClaim(OpenIdConnectConstants.Claims.Subject,
"71346D62-9BA5-4B6D-9ECA-755574D628D8",
OpenIdConnectConstants.Destinations.AccessToken);
identity.AddClaim(OpenIdConnectConstants.Claims.Name, user.login,
OpenIdConnectConstants.Destinations.AccessToken);
// ... add other claims, if necessary.
var principal = new ClaimsPrincipal(identity);
// Ask OpenIddict to generate a new token and return an OAuth2 token response.
return SignIn(principal, OpenIdConnectServerDefaults.AuthenticationScheme);
}
throw new InvalidOperationException("The specified grant type is not supported.");
}
and my Startup.cs code :
public void ConfigureServices(IServiceCollection services)
{
services.AddMvc();
services.AddDbContext<UserContext>(options =>
{
options.UseOpenIddict();
});
services.Configure<IdentityOptions>(options =>
{
options.ClaimsIdentity.UserNameClaimType = OpenIdConnectConstants.Claims.Name;
options.ClaimsIdentity.UserIdClaimType = OpenIdConnectConstants.Claims.Subject;
options.ClaimsIdentity.RoleClaimType = OpenIdConnectConstants.Claims.Role;
});
services.AddOpenIddict(options =>
{
options.AddEntityFrameworkCoreStores<UserContext>();
options.AddMvcBinders();
options.EnableTokenEndpoint("/connect/token");
options.AllowPasswordFlow().AllowRefreshTokenFlow()
.SetAccessTokenLifetime(TimeSpan.FromMinutes(20))
.SetRefreshTokenLifetime(TimeSpan.FromMinutes(10));
options.DisableHttpsRequirement();
});
services.AddDistributedMemoryCache();
services.Configure<IISOptions>(options =>
{
options.AutomaticAuthentication = true;
});
}
public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
loggerFactory.AddConsole(Configuration.GetSection("Logging"));
loggerFactory.AddFile("Logs/mylog-{Date}.txt");
loggerFactory.AddDebug();
app.UseOpenIddict();
app.UseOAuthValidation();
app.UseMvcWithDefaultRoute();
app.UseMvc();
}
The authentication and token generation are working, but not the refreshing of the token. I added SetAccessTokenLifetime(TimeSpan.FromMinutes(20)) and SetRefreshTokenLifetime(TimeSpan.FromMinutes(10));
The first one is working, my token expiration equals 20 minutes, but the token is never refreshed.