OIDC Azure AD token?

Question

I am trying to configure a third party web application to use Azure AD as the OIDC provider. The authentication works fine, however I am looking for some claims and not able to find an ID or Access Token. Here is the flow as I am seeing it

1. Call to the login page of the web application. This gets a 302 redirect to the Microsoft OAuth endpoint as below

2. The URL is https://login.microsoftonline.com/-tenantid-/oauth2/v2.0/authorize?client_id=-clientid-&redirect_uri=-encodedCallbackURI-&response_type=code&scope=openid+email+profile&state=123 This does a 302 to below URL

3. Next call is to https://login.microsoftonline.com/-tenantid-/oauth2/v2.0/authorize?client_id=-clientid-&redirect_uri=-encodedCallbackURI-&response_type=code&scope=openid+email+profile&state=123&**sso_nonce=O.eyJ0eXAiOiJK......**&client-request-id=-guid-&mscrid=-guid- This returns a 200

4. Next is the redirect back to the hosted web application indicated in teh callback - https://webApplicationURL/callback?code=0.AQ4Ayjxg80......&state=123&session_state=5b7c2e43-9eab-4bb1-9f24-d020f144d30d

At this point, the user has successfully been authenticated. However, I would like to find the ID or Access Token received.

The sso_nonce(in #3) is in a JWT format but has no claims.

The code(in #4) doesn't have any of the claims either and doesnt really seem to be a JWT token format.

So where is the ID Token or Access Token that I can use to decode and see what claims are getting passed (or not)?

Thanks in advance,

Jake.

Answer 1

To get tokens while calling login page of the web application, you can execute the below request in browser by including response_type as id_token+token:

https://login.microsoftonline.com/<tenant_ID>/oauth2/v2.0/authorize?
client_id=da5daf42-xxxx-xxxx-xxxxxx04a52 //your AppID
&response_type=id_token+token   //Required                    
&redirect_uri=https://jwt.ms   //your Redirect URL  
&response_mode=fragment                            
&scope=openid+profile+email                           
&state=12345                                          
&nonce=678910  

Make sure to enable tokens for your web application before executing the above request like below:

Go to Azure Active Directory -> App Registrations -> Your App -> Authentication -> Enable tokens -> Save

I tried to reproduce the same in my environment and got the below results:

When I executed the above-mentioned request in the browser, it asked me to sign in like below:

After successful sign-in, it took me to the redirect URL with tokens in the address bar like below:

When you copy-paste the above in Notepad or any, you can find both access_token and id_token like this:

I got the claims successfully when I decoded the token like below:

Reference: OpenID Connect (OIDC) | Microsoft Docs