AccessTokens returned for Active Directory are different between sample projects

Question

I've been experimenting with Azure Active Directory access for Java using two sample projects:

1) https://github.com/AzureAD/azure-activedirectory-library-for-java which builds a stand-alone war using OAuth tokens for security, and

2) https://github.com/Microsoft/azure-spring-boot/tree/master/azure-spring-boot-samples/azure-active-directory-spring-boot-backend-sample for spring-boot embeded containers

I've come across quite a difference in the way the APIs can be used, that I can't understand.

In both cases, I get an OAuth token for AD by logging in with my Azure credentials. In the Http response, I get an authorizationCode of the form:

AQABAAIAAAD.....

Then using the following URL as an authContext: https://login.microsoftonline.com/{tenantId}

I get a AuthenticationResult by making the following call:

Future<AuthenticationResult> future = authContext.acquireTokenByAuthorizationCode(authorizationCode, redirectUri, credential, null);

in the Adal4j project (1), the AuthenticationResult's AccessToken is of the form:

eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6I...

Which I can use as a Bearer token in an HTTP call to retrieve the user's profile picture via https://graph.windows.net/myorganization/me/thumbnailPhoto?api-version=1.6

whereas in the SpringBoot AD example, the AccessToken returned from exactly the same call is of the form:

AQABAAAAAADXzZ3ifr-GRbDT....

and If I use that in exactly the same way to try to retrieve the user's profile pic, I get a 401 Unauthorized response

What's the reason for the difference in the form and use of these AccessTokens?

Try looking at these tokens in decoded format using tools like jwt.io or jwt.ms and it might shed some more light on the differences.. — Rohit Saigal

Tom Sun - MSFT Tom Sun - MSFT · Accepted Answer · 2018-10-23T08:38:47

What's the reason for the difference in the form and use of these AccessTokens?

I assume that you got the access token is authorization_code not the bearer token.

As Rohit Saigal mentioned that you could use JWT.IO or JWT.MS to check that.

If we want to get the access token for Azure AD graph we could use the follow code to do that.

public String index(Model model, OAuth2AuthenticationToken authentication) {
...
DefaultOidcUser user = (DefaultOidcUser)authentication.getPrincipal();
String accessToken = user.getIdToken().getTokenValue(); 
...
}

Then we could use the access token to access the Azure AD graph api if you have assiged corrosponding permission.

AccessTokens returned for Active Directory are different between sample projects

1 Answers