Retrieve Access Token within a AAD secured Azure Web App

5
votes

I have an Angular4 Application hosted in an Azure Web App and a .NET core Web API hosted in an Azure API App.

The API is secured with Azure Active Directory. Currently I use ng2-adal to aquire an access token which I inject to the headers to perform my API calls.

Now I try to remove the ng2-adal module and secure my Web App with the Authentication / Authorization feature using the same ClientId (like the API). When I browse to my website I get redirected to the AAD login and after I successfully login, I get redirected to my site. Now I wan't to call the API (that is secured with the same ClientId) within my Web App but can't find a way to retrieve the token.

Is there a way to retrieve the access token within my Angular App in this scenario? It looks like the token is stored encrypted within the AppServiceAuthSession Cookie:

enter image description here

3
angularjsazureazure-active-directory
I am not sure if I understand the scenario, but you should have the necessary token in the reply url docs.microsoft.com/en-us/azure/active-directory/develop/… – Sentinel
@Sentinel Thanks for your help. Unfortunately the example you are referencing is using adal.js. – Martin Brandl
I don't think it is referencing any library at all, it's just saying that the token is in the reply url. – Sentinel
Anyhow, I can't find a token within the reply url. – Martin Brandl

3 Answers

10
votes

The AppServiceAuthSession is cookie which is different than a token. In this scenario, you need to modify the config of Azure app to make it acquire the access_token for the web API.

We can use the Resource Explore to modify the settings like below:

1 . locate the angular web app

2 . locate the config->authsettings(resource is the clientId of Azure app which used to protect your apps)

"additionalLoginParams": [
  "response_type=code id_token",
  "resource=3fa9607b-63cc-4050-82b7-91e44ff1df38"
],

3. config the redirect_uri for Azure app like below: https://appfei.azurewebsites.net/.auth/login/aad/callback

Then after you login in the angular app, you can get the access_token via the endpoint: https://appfei.azurewebsites.net/.auth/me

enter image description here

Then we need to protect the web API using the Advanced Azure Active Settings like figure below to enable the access_token could call the web API: enter image description here

4
votes

I've been working on this for a week. So, I'd like to share how I got it.

I was able to have authentication for my app using AAD.

I have AppServiceAuthSession in my cookies storage.

Then on my application, I called the auth/me API.

https://yourwebsite.azurewebsites.net/.auth/me

So, it's like: 

this.$http
  .get('https://yourwebsite.azurewebsites.net/.auth/me').then(response => {
    console.log(".auth/me", response)
  }, err => {
    console.log("Error: ", err)
  })

I'm actually using Vue. calling your HTTP might be different. And that's it.

I basically called the auth/me API to retrieve the information I needed.

P.S. You need to be authenticated of course.

0
votes

found this solution:

just need to add your app url on Authentication / Authorization-> ALLOWED EXTERNAL REDIRECT URLS

so the webapi will automatically accept those cookies.

ps: make sure your ajax request is passing those cookies on it.