Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.
Sign upCorrectly utilize JWT tokens instead of normal accessTokens for AzureAD #403
Comments
This comment has been minimized.
This comment has been minimized.
Please post updates as new comments, this makes it easier to spot them ;) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
AzureAD requires you to utilize the JWT token when you provide a resource id. Currently the default behaviour in Bell is utilizing the non resource id configuration, making it fail on retrieving the User Credentials because this endpoint utilizes a non JWT authorization.
In more details:
Default:
Profile will be gotten through the current provider calling:
Resource ID:
When providing a resource id such as:
An error will be thrown stating "InvalidAuthentication" because a JWT token is retrieved now rather than a normal token (see: https://stackoverflow.com/questions/28631635/cannot-access-openid-userinfo-endpoint-on-azure-aadsts90010-jwt-tokens-cannot)
This should be handled correctly, and in this case the JWT should be decoded and the user details should be retrieved from the JWT claim
Update 27/MAR: This should change to utilize the v2 endpoints to enable a correct handling for retrieving the user profile as well as changing the resource declaration to scopes
e.g. https://graph.microsoft.com/beta/me/ with access token