CODEWITHSUNDEEP
angularazureoauth-2.0azure-active-directoryangular-oauth2-oidc
Mikey123
Mikey123

Reputation: 1429

OAuthService wrong issuer error (angular-oauth2-oidc)

I'm currently trying to implement azure ad authentication in my angular application. Unfortunately i'm running into some issues. The following code gives me the access token as i'm expecting. To implement it in my api I wanna use OpenIDConnect.

export class AppComponent implements OnInit {
  title = 'Sign in test';

  constructor(private oauthService: OAuthService) {

  }

  private async ConfigureAuth(): Promise<void> {
    this.oauthService.configure({
      loginUrl: 'loginUrl',
      clientId: 'clientId',
      resource: 'resource',
      logoutUrl: 'logoutUrl',
      redirectUri: window.location.origin + '/',
      scope: 'openid',
      oidc: false
    });   
    this.oauthService.setStorage(sessionStorage);  
  }

  async ngOnInit() {
    await this.ConfigureAuth();

    this.oauthService.tryLogin({});

    if(!this.oauthService.getAccessToken()) {
      await this.oauthService.initImplicitFlow();
    }

    console.log(this.oauthService.getAccessToken());
  }
}

The sign in still works as it gives me the access token but when i set oidc to true it gives me the following errors:

angular-oauth2-oidc.js:1146 Error validating tokens
(anonymous) @ angular-oauth2-oidc.js:1146

Wrong issuer: https://sts.windows.net/{tenantid}/

ERROR Error: Uncaught (in promise): Wrong issuer: https://sts.windows.net/{tenantid}/

I'm not sure how to solve this issue, as the issuer in this case has the correct tenant ID.

Hope someone can help me out with this.

Upvotes: 2

Views: 10394

Answers (1)

Martin Brandl
Martin Brandl

Reputation: 59001

There is a related open issue on GitHub: Valid access_token but no identity. The reason for that is probably because AAD doesn't support CORS for .well-known/openid-configuration. At least that is the case for AAD B2C. I was able to solve it by manually specify the discovery config:

export const aadB2cNoDiscoveryConfig: AuthConfig = {
  'clientId': XXX
  'redirectUri': XXX
  'loginUrl': XXX
  'logoutUrl': XXX
  'scope': 'openid https://mytenant.onmicrosoft.com/myapi/user_impersonation',
  'oidc': true,
  'issuer': 'https://login.microsoftonline.com/XXX/v2.0/',
  'tokenEndpoint': 'https://login.microsoftonline.com/XXX.onmicrosoft.com/oauth2/v2.0/token?p=b2c_1_signin',
  'responseType': 'id_token token',
  'clearHashAfterLogin': true,
  'disableAtHashCheck': true,
  'showDebugInformation': true,
  'strictDiscoveryDocumentValidation': false,
  'jwks': {
    'keys': [
      {
        kid: XXX
        nbf: XXX,
        use: XXX
        kty: XXX
        e: XXX
        n: XXX
      }]
  }

Note: I used AAD B2C.

Upvotes: 1

Related Questions