You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The first using Office.auth.getAccessToken will return a JWT containing the user Id details (that then needs to be converted to a Graph access token using OBO flow on the server), but when falling back to getAccessTokenMSAL, the returned JWT is a full MS Graph access token that can be used directly in the add-in (scp has all the Graph rights). Trying to use the JWT returned from MSAL blindly for the OBO flows fails the documented validation rules for a userId JWT (iss starts with https://login.microsoftonline.com, scp=access_as_user etc). Shouldn't both calls return the same thing - i.e. the msal response.idToken rather than response.accessToken?
To Reproduce
Edit the code in authRedirect.js to return the full response back to the calling add-in
URL of sample
Office-Add-in-NodeJS-SSO
Describe the bug
In the sample for SSO falling back to MSAL, the getAccessToken() function in ssoAuthES6.js does essentially:
The first using Office.auth.getAccessToken will return a JWT containing the user Id details (that then needs to be converted to a Graph access token using OBO flow on the server), but when falling back to getAccessTokenMSAL, the returned JWT is a full MS Graph access token that can be used directly in the add-in (scp has all the Graph rights). Trying to use the JWT returned from MSAL blindly for the OBO flows fails the documented validation rules for a userId JWT (iss starts with https://login.microsoftonline.com, scp=access_as_user etc). Shouldn't both calls return the same thing - i.e. the msal response.idToken rather than response.accessToken?
To Reproduce
Expected behavior
If getAccessTokenMSAL() is supposed to reproduce Office.auth.getAccessToken(), I expected to get the idToken from the MSAL function call.
Environment
Additional context
The text was updated successfully, but these errors were encountered: