Invalid token received from adal.js

Question

I'm trying to create a small client-side webapp with adal.js (currently without the angular part).

I have manged to login and get an authenticated user object. However I'm getting an invalid OAuth token from the API apparently.

The configuration I'm sending to the AuthenticationContext instance:

var config = {
    instance: 'https://login.microsoftonline.com/',
    tenant: 'dbaa88b3-...',
    clientId: 'f81bede8-...',
    postLogoutRedirectUri: window.location.href,
    cacheLocation: 'localStorage', 
};

Not sure if it's suppose to be the tenant ID or tenant name?

Then when I'm authenticated I'm using

var context = new AuthenticationContext(config);
context.acquireToken(context.config.clientId, function(error, token) {
       // error is null
       var now = new Date();
       $.ajax({
          url: "https://outlook.office365.com/api/v1.0/me/calendarview",
          method: "GET",
          data: {
             "startdatetime": (new Date()).toISOString(),
             "enddatetime": (new Date()).toISOString()
          },
          headers: {
             "Authorization": "Bearer " + token,
             "Accept": "application/json; odata.metadata=full",
             "Client-Request-Id": clientid, // Some unique machine id?
             "User-Agent": navigator.userAgent,
             "Date": now.toUTCString()
          }
       }).then(function(result) {},
       function(e) {
          console.error(e);
          // 401 response, x-ms-diagnostics header = 2000005;reason="The PUID value was not found for [ORGID] identity.";error_category="invalid_user"
       });     
});

If I manually input an authentication token generated with the same account on https://oauthplay.azurewebsites.net/ it succeeds.

Could you use this site to decode the two tokens and compare: jwt.io — Rich Randall

vikke vikke · Accepted Answer · 2015-06-01T09:30:30

tl;dr dont send the client id as first parameter to acquireToken if you want the access token

Seems like I was using the library wrong.

When calling acquireToken and you want the access token you should not provide the clientId as first parameter, then you will get the identification token (was able to figure this out with the http://jwt.io/# tool, thanks @rich-randall). That is at least how I interpret the code.

So I was providing the identification instead of the access token to the API, which does not contain the "puid" value, hence the error message:

// 401 response, x-ms-diagnostics header = 2000005;reason="The PUID value was not found for [ORGID] identity.";error_category="invalid_user"

Now I'm able to extract data from the API.

Invalid token received from adal.js

1 Answers