CODEWITHSUNDEEP
oauth-2.0azure-active-directorypostmanadaladal.js
Tomas Aschan
Tomas Aschan

Reputation: 60664

Reproducing an ADAL.JS-authenticated request in Postman

I have a .NET Web API and a small vanilla-JS app using ADAL.js, and I've managed to make them talk nicely to each-other and authenticate correctly.

If I console.log the token returned from adalAuthContext.acquireToken() and manually enter it as Authorization: Bearer {{token}} in Postman, I can also get a valid, authenticated, response from my backend.

However, I can't figure out how to configure Postman's built-in OAuth2.0 authentication UI to get me tokens automatically. I have managed to get tokens in several ways, but none of them are accepted by the backend.

How do I configure Postman to get a token the same way the ADAL.js library does?

For completeness, here's some code:

Backend configuration:

public void Configuration(IAppBuilder app)
{
    app.UseCors(CorsOptions.AllowAll);

    app.UseWindowsAzureActiveDirectoryBearerAuthentication(
        new WindowsAzureActiveDirectoryBearerAuthenticationOptions
        {
            TokenValidationParameters = new TokenValidationParameters { ValidAudience = "<app-id>" },
            Tenant = "<tenant>",
            AuthenticationType = "WebAPI"
        });

    var config = new HttpConfiguration();
    config.MapHttpAttributeRoutes();
    app.UseWebApi(config);
}

ADAL.js configuration:

const backendUrl = 'http://localhost:55476';
const backendAppId = '<app-id>';

const authContext = new AuthenticationContext({
  clientId: backendAppId,
  tenant: '<tenant>',
  endpoints: [{ [backendAppId]: backendAppId }],
  cacheLocation: 'localStorage'
});

Actually making a request:

authContext.acquireToken(backendAppId, (error, token) => {
   // error handling etc omitted
   fetch(backendUrl, { headers: { Authorization: `Bearer ${token}` } })
       .then(response => response.json())
       .then(console.log)
})

Upvotes: 1

Views: 607

Answers (1)

juunas
juunas

Reputation: 58853

So since the Azure AD v1 endpoint is not fully standards-compliant, we have to do things in a slightly weird way.

In Postman:

  1. Select OAuth 2.0 under Authorization
  2. Click Get new access token
  3. Select Implicit for Grant Type
  4. Enter your app's reply URL as the Callback URL
  5. Enter an authorization URL similar to this: https://login.microsoftonline.com/yourtenant.onmicrosoft.com/oauth2/authorize?resource=https%3A%2F%2Fgraph.microsoft.com
  6. Enter your app's application id/client id as the Client Id
  7. Leave the Scope and State empty
  8. Click Request token

If you configured it correctly, you'll get a token and Postman will configure the authorization header for you. Now about that authorization URL. Make sure you specify either your AAD tenant id or a verified domain name instead of yourtenant.onmicrosoft.com. Or you can use common if your app is multi-tenant. The resource is the most important parameter (and non-standards-compliant). It tells AAD what API you want an access token for. In this case I requested a token for MS Graph API, which has a resource URI of https://graph.microsoft.com. For your own APIs, you can use either their client id or App ID URI.

Here is a screenshot of my settings:

Postman OAuth 2 settings

Upvotes: 1

Related Questions