CODEWITHSUNDEEP
oauth-2.0azure-active-directory
Ronaldo Lanhellas
Ronaldo Lanhellas

Reputation: 3336

scp claim in Azure AD Acess Token

I'm developing a communication flow through Azure AD with OAuth2. So, I'm testing two flows:

 - Credentials Flow
 - Authorization Code Flow

Everything works fine, except one thing: The Scope/permission (scp) in the Access Token.

When I request an Access Token with the Authorization Code Flow I have a lot of claims and one very important for my business: the scp. This claim has all scopes configured in the Azure portal.

But when I use the Client Credentials Flow this "scp" claim does not return and I can't check if this Access token generated can access an Endpoint in my resource server.

Any idea how to solve this?

Upvotes: 2

Views: 7456

Answers (2)

Mathieu Diepman
Mathieu Diepman

Reputation: 149

the answer to this question explains quite well why it's not working.

Since there is no redirection (there's not user involved) scp claims are not returned. the solution to your problem is to use application roles.

When you get the OAuth2 token using the client_credentials flow, make sure you are passing the resource parameter and populate it with the appId of the application where you added the roles to the manifest.

Upvotes: 1

srini
srini

Reputation: 153

Have a look at these two links . Looks like you are correct in the client credential flow scp claims are not visible

Getting the access token for Microsoft Graph API

https://joonasw.net/view/defining-permissions-and-roles-in-aad

Upvotes: 0

Related Questions