OpenId Connect Only Token AAD

Question

Is it possible to only get an id_token from AAD? I have a really simple situation where my angular app needs to have the username of the user, and my api layer is wide open.

I thought I could set my clientid and resource to the clientId of my angular app in AAD but I'm getting a :

"AADSTS65005 Invalid resource. The client has requested access to a resource which is not listed in the requested permissions in the client application registration"

This is in the implicit grant flow.

---EDIT

For example if i send this initial redirect to initiate the implicit grant:

https://login.microsoftonline.com/{{MY-TENANT-HERE}}/oauth2/authorize?response_type={{id_token}}&client_id={{CLIENTID-HERE}}&state={{STATE-HERE}}&redirect_uri={{REDIRECTURI-HERE}}&scope={{openid profile email}}&nonce={{nonce-here}}&resource={{CLIENTID-HERE}}

produces this:

"AADSTS65005 Invalid resource. The client has requested access to a resource which is not listed in the requested permissions in the client application registration"

If I don't send a resource (IE the following request):

  https://login.microsoftonline.com/{{MY-TENANT-HERE}}/oauth2/authorize?response_type={{id_token}}&client_id={{CLIENTID-HERE}}&state={{STATE-HERE}}&redirect_uri={{REDIRECTURI-HERE}}&scope{{openid profile email}}&nonce={{nonce-here}}

I get a message that says resource is required. So my question is, say I have no backend, but my front end needs to know who the user is, how is that supported in AAD?

You can get the id token when you authenticate the user by specifying response_type=id_token, which will work since you have implicit grant enabled. I guess you are trying to get it with e.g. ADAL.JS's getAccessToken function? — juunas
Could you post more details about your question? Such as, the request head and body. — Wayne Yang

Marilee Turscak - MSFT Marilee Turscak - MSFT · Accepted Answer · 2018-05-18T17:34:45

This issue occurs because the your angular app may not be registered with Azure AD, or it may not have the correct permissions applied.

Try creating a new app registration for your Angular app under the correct tenant in the Azure portal, if you have not done so already. Using the access token or id token is the correct way to access user profiles.

https://developer.microsoft.com/en-us/graph/docs/concepts/auth_overview

OpenId Connect Only Token AAD

1 Answers