Integration of Angular Application and Spring Boot with Azure AD

Question

I am building an application using angular and spring boot. I need to use Azure AD for SSO from frontend then secure the spring boot services using the token. (In short my angular will connect with office 365 to login and then the user will authenticate connect with spring security, where it will verify the token, if valid it will give a response.) In angular, I am using adal-angular4 and in spring boot azure-active-directory-spring-boot-starter. Also, how to register the application(Frontend and backend) in Azure AD portal.

I am tried using some article. I get the response from the postman when I hit the URL using the token.

{
    "code": 500,
    "status": "failure",
    "path": "/api/echo",
    "message": "com.microsoft.aad.adal4j.AuthenticationException: {\"error_description\":\"AADSTS500131: Assertion audience does not match the Client app presenting the assertion. The audience in the assertion was '48eb1c7f-e02b-43a9-913a-XXXXXXXX' and the expected audience is 'a3edefea-1ff3-43ed-b2d7-=XXXXXXXXXXXXX' or one of the Application Uris of this application with App ID 'a3edefea-1ff3-43ed-b2d7-=XXXXXXXXXX'(PulseBE).\\r\\nTrace ID: 2aced69c-f12d-4b5d-97db-XXXXXXXXXX\\r\\nCorrelation ID: 226816c8-a2ed-488c-86ec-XXXXXXXXXXXXXXXX\\r\\nTimestamp: 2019-06-17 19:10:34Z\",\"error\":\"invalid_grant\",\"error_uri\":\"https:\\/\\/login.microsoftonline.com\\/error?code=500131\"}",
    "timeStamp": "Tue Jun 18 00:40:35 IST 2019",
    "trace": null
}

Sammy Cakes Sammy Cakes · Accepted Answer · 2019-06-19T19:41:09

iamelix, I had the same problem. My issue was that my auth URL and token URL did not include the resource parameter.

The format of the Azure auth URL and token URL are below.

Postman Azure AD

Auth URL format: https://login.microsoftonline.com/[tenant_id]/oauth2/authorize?resource=[application_id]

Access Token URL format: https://login.microsoftonline.com/[tenant_id]/oauth2/token?resource=[application_id]

The key for me was adding the resource parameter to the auth URL and token URL, and now my requested token includes the valid audience so it is accepted by Azure AD with no errors. I found the above information from this very helpful article: https://www.bruttin.com/2017/11/21/azure-api-postman.html

Integration of Angular Application and Spring Boot with Azure AD

1 Answers