public void ConfigureServices(IServiceCollection services)
{
            <snip>

            AddCookie(options =>
            {
                options.LoginPath = "/signin";
                options.LogoutPath = "/signout";
                options.Events = new CookieAuthenticationEvents
                {
                    OnValidatePrincipal = async x =>
                    {
                        await AdoOAuthUtils.OnValidatePrincipal(x, Configuration);
                    }
                };
            });
}

        public static async Task OnValidatePrincipal(CookieValidatePrincipalContext context, IConfiguration configuration)
        {
            if (context.Principal.Identity.IsAuthenticated)
            {
                var tokens = context.Properties.GetTokens();
                var refreshToken = tokens.FirstOrDefault(t => t.Name == "refresh_token");
                var accessToken = tokens.FirstOrDefault(t => t.Name == "access_token");
                var expiresAt = tokens.FirstOrDefault(t => t.Name == "expires_at");
                var expireTime = DateTime.Parse(expiresAt.Value);
                var nowPlus5min = DateTime.Now + TimeSpan.FromMinutes(5);
                // If this token expires in next 5 mins, renew it.
                if (expireTime < nowPlus5min)
                {
                    var tokenModel = await RefreshToken(refreshToken.Value, configuration);
                    if (tokenModel.IsError)
                    {
                        context.RejectPrincipal();
                        return;
                    }
                    refreshToken.Value = tokenModel.RefreshToken;
                    accessToken.Value = tokenModel.AccessToken;
                    var newExpires = DateTime.UtcNow + TimeSpan.FromSeconds(tokenModel.ExpiresIn);
                    expiresAt.Value = newExpires.ToString("o", CultureInfo.InvariantCulture);
                    context.Properties.StoreTokens(tokens);
                    context.ShouldRenew = true;
                }
            }
        }
        private static async Task<TokenModel> RefreshToken(string refreshToken, IConfiguration configuration)
        {
            TokenModel tokenModel = new TokenModel();
            if (!String.IsNullOrEmpty(refreshToken))
            {
                HttpClient httpClient = new HttpClient();
                HttpRequestMessage requestMessage = new HttpRequestMessage(HttpMethod.Post, AdoAuthenticationDefaults.TokenEndPoint);
                requestMessage.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

                Dictionary<String, String> form = new Dictionary<String, String>()
                {
                    { "client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer" },
                    { "client_assertion", configuration["AzureClientSecret"] },
                    { "grant_type", "refresh_token" },
                    { "assertion", refreshToken },
                    { "redirect_uri", "https://localhost:44352" + AdoAuthenticationDefaults.CallbackPath }
                };
                requestMessage.Content = new FormUrlEncodedContent(form);

                // Make the request to exchange the auth code for an access token (and refresh token)
                HttpResponseMessage responseMessage = await httpClient.SendAsync(requestMessage);

                if (responseMessage.IsSuccessStatusCode)
                {
                    // Handle successful request
                    String body = await responseMessage.Content.ReadAsStringAsync();
                    tokenModel = JObject.Parse(body).ToObject<TokenModel>();
                }
                else
                {
                    tokenModel.IsError = true;
                    tokenModel.ErrorMessage = responseMessage.ReasonPhrase;
                }
            }
            else
            {
                tokenModel.IsError = true;
                tokenModel.ErrorMessage = "Invalid refresh_token";
            }

            return tokenModel;
        }