Azure AD 2.0 application - can't access scope from angular client

Question

I'm trying to develop Angular 4 application and ASP.NET Core 2.0 backend. I have angular application (generated using Angular-cli) and .net core web api (generated using vs 2017 template). On angular side I'm using angular-oauth2-oidc. I registered my application using AzureAD app registration portal (app s registered as v2.0) in the app configuration there is two platforms Web and Web API. In Web api platform there is defined scope named "api:///access_as_user" and my application is given access to this scope.

On angular side that's it. On .NET side there is .AddJwtBearer() method that has configured authority, audience (clientId).

services.AddAuthentication(auth =>
        {
            auth.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
            auth.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
        })
        .AddCookie()
        .AddJwtBearer(cfg =>
        {
            cfg.Authority = "https://login.microsoftonline.com/<tenantId>/v2.0";                
            cfg.Audience = "<clientId>";
            //cfg.Configuration = new Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfiguration();
            cfg.TokenValidationParameters = new TokenValidationParameters()
            {
                ValidateAudience = false,
                ValidIssuer = "https://login.microsoftonline.com/<tenantId>/v2.0"
            };              
        });

The problem occurs when I tried to access my web api from client application. If I don't ask for my scope ("api:///access_as_user") in angular, web api return 401 unauthorized. I I ask for it I get

"AADSTS65005:The application 'Angular-test' asked for scope 'access_as_user' that doesn't exist on the resource. Contact the app vendor.
Trace+ID: c55338dd-35c8-429b-bfe1-5c48ac030d00
Correlation+ID: a0b4bc2d-7f15-4ca4-9cd5-4fe61999e4d9 
Timestamp:+2017-10-24+10:35:56Z""

Anyone has the same/simular issue?

Git repositories:

Client --> branch oidc

Servier

Fei Xue · Accepted Answer · 2017-10-26T05:49:52.310

2

I am able to call the web api by not using the customize scope. Here are the steps for your reference:

1.Acquire the token using the implicit flow like below:

GET: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token&client_id=1e6af2ed-686c-4914-96ed-0cd7b1673cbb&scope=openid&redirect_uri=http%3A%2F%2Flocalhost&nonce=123

2.1 multi-tenant:

Call the .net core web API using the id_token above which protect the Azure AD V2.0 app like code below:

app.UseJwtBearerAuthentication(new JwtBearerOptions
{
        Authority = "https://login.microsoftonline.com/common/v2.0/",
        Audience = Configuration["Authentication:AzureAd:ClientId"],
        Events = new JwtBearerEvents
        {
            OnAuthenticationFailed = AuthenticationFailed
        },
        TokenValidationParameters=new Microsoft.IdentityModel.Tokens.TokenValidationParameters
        {
            ValidateIssuer =false,          
        } 
    });        
});

2.1 limit the tenants as you wanted:

app.UseJwtBearerAuthentication(new JwtBearerOptions
{
    Authority = "https://login.microsoftonline.com/common/v2.0/",
    Audience = Configuration["Authentication:AzureAd:ClientId"],
    Events = new JwtBearerEvents
    {
        OnAuthenticationFailed = AuthenticationFailed
    },
    TokenValidationParameters=new Microsoft.IdentityModel.Tokens.TokenValidationParameters
    {
        ValidateIssuer =true,
        ValidIssuers=new string[] { "list the allowed issues here","https://login.microsoftonline.com/xxxxxxxx-0e9b-42f8-8b22-3c4a2f1d8800/v2.0"}
    } 
});

You can refer the code sample below about protecting the web api using Azure AD V2.0 app. The code sample is for Azure AD B2C, we can modify its authority to make it working for Azure AD V2.0 app. And please feel free to let me know if you still have the problem.

active-directory-b2c-dotnetcore-webapi

edited Oct 26 '17 at 05:49

answered Oct 25 '17 at 09:38

Fei Xue

14,369
1
19
27

In this sample only difference is Authority /common/ I get /tenantId/. As far as I know common is for multitenant apps. But I don't see any button for choosing multitenant apps on new portal (in azure there is button). I added links to demo projects, can you please take a look and maybe give me some hint. If you try to run it (client branch oidc) you will see that i get the token (console and session storage) in app.component.ts in line 23 I ser scope only for graph api now. But server reject token with 401. Action that triggers request with token is Books --> Add. – Alan Jagar Oct 25 '17 at 14:19
@AlanJagar The app which using Azure AD V2.0 endpoint supports the multi-tenant by default. Is the apps only for your organization? If yes, you can limit the issues using the `ValidIssuers`. I have update the code for these two scenarios. Please let me know if you have problem. – Fei Xue Oct 26 '17 at 05:30
I need multitenant. I tried your example but still get an 401. Client app redirect me to this url `https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token%20token&client_id=2183b5f0-4529-4e72-a6b4-4e06fe2c4a73&state=cF3oAQwuiNM6pGb72Z6urmTd3F1Wm7bKyqDuYSAn&redirect_uri=http%3A%2F%2Flocalhost%3A4200%2Fhome&scope=openid&nonce=cF3oAQwuiNM6pGb72Z6urmTd3F1Wm7bKyqDuYSAn` And I get the token, but server is still give me 401. – Alan Jagar Oct 26 '17 at 06:24
If you don't want to limit the tenants, you can just disable the issue verifying. For the 401 error, is there any detailed error message? – Fei Xue Oct 26 '17 at 06:27
Server code: `.AddJwtBearer(cfg => { cfg.Audience = "2183b5f0-4529-4e72-a6b4-4e06fe2c4a73"; cfg.Authority = "https://login.microsoftonline.com/common/v2.0"; //cfg.Configuration = new Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfiguration(); cfg.TokenValidationParameters = new TokenValidationParameters() { ValidateIssuer =false }; });` – Alan Jagar Oct 26 '17 at 06:35
The token you are acquiring is the access token for Microsoft Graph. You should send the **id_token** instead of the **access_token**. – Fei Xue Oct 26 '17 at 06:35
1

Normally, the access token is specific for the target resource via the `aud` claim. However Azure AD V2.0 seems have problem to acquire the access_token for the customize web API. So as a workaround, you can send the id_token to your web API. Please let me know if it helps. – Fei Xue Oct 26 '17 at 06:37
It's working :). Thanks so much. So as far as I understood when I call graph api I need to send access token and when I call my web api I need to send Id_token. – Alan Jagar Oct 26 '17 at 06:41

Azure AD 2.0 application - can't access scope from angular client

1 Answers1

Linked