Consent prompt does not ask for all permissions which are set in AD App after moving to v2.0 authority

Question

We have a multi-tenant AD App that we use for signing in users to our App using OpenID Connect. We recently moved to v2.0 authority endpoint, post which we are facing an issue wherein the consent prompt which is shown during the login process does not show all the permissions which have been configured in the 'Permissions' section of the App. This is unlike the behavior of v1.0 authority endpoint which used to show prompt for all the set permissions. Below is the relevant code snippet from our Startup.cs -

.AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =>
            {
                options.CallbackPath = new PathString("/callback/");
                options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                options.SaveTokens = true;
                options.ClientId = <clientId>;
                options.Authority = "https://login.microsoftonline.com/common/v2.0/";
                options.ResponseType = OpenIdConnectResponseType.CodeIdToken;
                options.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuer = true,
                    ValidIssuer = <valid-issuer>,
                    IssuerValidator = MultiTenantIssuerValidator.Validate,
                    ValidateAudience = true,
                    ValidateLifetime = true,
                    ValidateIssuerSigningKey = true,
                    ValidAudience = <client-id>,
                    NameClaimType = "preferred_username"
                };

Redirect Uri with v2.0 endpoint - https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=&redirect_uri=&response_type=code id_token&scope=openid profile&response_mode=form_post

Redirect Uri with v1.0 endpoint - https://login.microsoftonline.com/common/oauth2/authorize?client_id=&redirect_uri=&response_type=code id_token&scope=openid profile&response_mode=form_post

I tried to go through the documentation for v2 endpoint and did not find any section which explains this behavior change.

Are we explicitly supposed to set all required scopes in OpenIdConnectOptions?

If my answer is helpful for you, you can accept it as answer( click on the check mark beside the answer to toggle it from greyed out to filled in.). See meta.stackexchange.com/questions/5234/…. This can be beneficial to other community members. Thank you. — Allen Wu

Allen Wu Allen Wu · Accepted Answer · 2020-04-26T01:32:47

Yes. The behaviors are different between v1.0 and v2.0.

For v2.0 endpoint, you should include the resource in the scope.

For example, if your permission is Microsoft Graph, you should generate the request uri like this:

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=&redirect_uri=&response_type=code id_token&scope=openid profile https//graph.microsoft.com/.default&response_mode=form_post

If your permission is for your custom web API, you just need to replace https//graph.microsoft.com/.default with api://*****/.default.

Then it will ask you to consent for all the permissions.

See the v2.0 sample Request an authorization code for details.

Consent prompt does not ask for all permissions which are set in AD App after moving to v2.0 authority

2 Answers