Authenticating with Azure AD using UPN (User principal name)

1
votes

I have Angular 9 client calling Azure Functions. I started off with msal-angular package using "implicit grant flow" for authentication, and that worked fine.

My client app registration in Azure has its Authentication set to "Accounts in this organizational directory only (Default Directory only - Single tenant)". I can't change this setting as the app will only be available to company users.

I'm using my personal Microsoft account with Gmail username (e.g.: [email protected]). This account is a "Guest" in Azure AD, so far, so good.

I'm moving away from msal-angular and implementing PKCE authentication flow.

I'm using angular-auth-oidc-client package. My stsServer and authWellknownEndpoint are set to https://login.microsoftonline.com/[tenant-id]/v2.0 (turned out to be the problem, see update at the bottom)

Here are the login scenarios I'm having issues with:

  1. When I use my [email protected], I get "unauthotized_client ..." error right after I enter my username enter image description here

  2. When I use my UPN (e.g.: [email protected]#EXT#@our_ad_owner.onmicrosoft.com) I get to the password prompt, but my Microsoft password doesn't work. I understand why it doesn't work (that password has nothing to do with AD), but I can't figure out how to set AD password for that account.

When I try to reset my password in AD, it tells me that "[email protected] is a Microsoft account that is managed by the user. Only [email protected] can reset their password for this account."

Any help with setting AD password for my UPN would be appreciated. I would also like to know if it's possible to login with my actual email address, and not UPN.

UPDATE: The problem was with angular-auth-oidc-client setup, authWellknownEndpoint was set to https://login.microsoftonline.com/common/v2.0, after I changed it to https://login.microsoftonline.com/[tenant-id]/v2.0 it worked!

1
azureoauth-2.0azure-active-directory
Is your authority configured to be your tenant in the front-end? – juunas
If everything works correctly, you should get redirected to personal MS account login page from AAD login page.. – juunas
@juunas client configuration is fine, it worked with "implicit grant flow", I'm reusing same client, just disabled "Access tokens" and "ID tokens" to enable PKCE – roman m
@juunas authority: login.microsoftonline.com/[tenant-id]/v2.0 – roman m
And you changed the platform to SPA in app registration? – juunas

1 Answers

2
votes

You get the first error because you are using https://login.microsoftonline.com/common/v2.0 as the authority. It treats your account as personal account rather than the guest account in your tenant. But your Azure AD app is configured as Accounts in this organizational directory only (Default Directory only - Single tenant), which is not supported for consumers (personal account). See the reference here.

So you should use https://login.microsoftonline.com/{your tenant id}/v2.0 as the authority. Then it will allow your [email protected] to sign in.