Cloud Identity

Anonymous
2020-08-17T20:58:57.217+00:00

We are building a IAM service to generate and authenticate/authorize client requests via the client_credentials flow. We are using Microsoft Identity Platform (V2) to generate tokens with a default scope (./default) and subsequently trying to authenticate and authorise the API Permissions. We are unable to do so as the generated token does not have the scope/roles claim and gets rejected by the passport-azure-ad Bearer Strategy module.

Can anyone tell me what steps am i missing.

Thanks in advance.

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

2 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    13 deleted comments

    Comments have been turned off. Learn more

  2. soumi-MSFT 11,636 Reputation points Moderator
    2020-08-18T06:58:52.9+00:00

    anonymous user, Thank you for reaching out. The first thing to note here is, the both roles and scopes are not available together in a token, the reason being, roles get listed when you use the client_credential flow of OAuth along with adding Application Permissions on the App Registration. Similarly, scopes get listed in the access token, when you use OAuth flows like Authorization_Code Grant Flow or Implicit Flow etc along with adding the Delegated Permissions on the App Registration.

    In this case, since you are using Client_credential flow of OAuth, I would recommend you to check and confirm if you are using Application Permissions along with Admin Grant on them. As if the application permissions are mission, you would miss them in the token too under the scp key (scope).

    Hope this helps.

    Do let us know if this helps and if there are any more queries around this, please do let us know so that we can help you further. Also, please do not forget to accept the response as Answer; if the above response helped in answering your query.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.