0

I have two different Registration Apps on Azure AD and I would like App 2 to be able to impersonate a user of App 1. My 2 apps belong to the same tenant. I added in the permissions of App 2 the scope user_impersonation (see picture).

Azure AD Scope

Then I created an express server with passport in order to realize the oauth.

const app = express()

passport.use("my-strategy", new MicrosoftStrategy({
  clientID: "my-client-id",
  clientSecret: "my-client-secret",
  callbackURL: "http://localhost:3000/auth/microsoft/callback",
  tenant: "my-tenant-id",
}, function (accessToken: string, refreshToken: string, params: any, profile: any, done: any) {
  try {
    let user = {
      accessToken: accessToken,
      refreshToken: refreshToken,
    }

    console.log(user);
  } catch (error) {
    console.log('error on login');
    console.log(error)

    return done(error)
  }
}));

app.use(passport.initialize());

app.get('/', (req, res) => {
  res.send("Express Server")
});

app.get('/auth/microsoft/login',
  passport.authenticate('my-strategy'));

app.get('/auth/microsoft/callback',
  passport.authenticate('my-strategy', { failureRedirect: '/failure' }),
  function (req, res) {
    res.redirect('/success');
  });

app.get("/success", (req, res) => {
  res.send("Success");
});

app.get("/failure", (req, res) => {
  res.send("Failure");
});

app.listen(3000, () => {
  console.log("Server running on 3000");
})

No problem so far, I can make my request and get an access token and a refresh token. By looking at the content of the access token I have the scope "user_impersonation".

The problem occurs when using this token. It is impossible for me to access the App 1 with this token.

1 Answer 1

0

I tried to reproduce the same in my environment and got the results successfully like below:

I registered two Azure AD applications app1 and app2.

In the app1, I exposed an API and added scope like below:

enter image description here

Now, in the app2, add the API permission like below:

Go to Azure Active Directory -> App Registrations -> app2 -> API permissions -> Add a permission -> My APIs -> app1

enter image description here

And Grant the Admin consent for the API Permissions.

Now, I generated the token for app2 to access app1 using Postman using below parameters:

GET https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id:app2ClientID
client_secret:app2clientsecret
grant_type:authorization_code
scope:api://App1clientID/user_impersonation
redirect_uri:redirect_uri
code:code

The access token got generated successfully with the api://***/user_impersonation successfully like below:

enter image description here

When I decoded the token, the aud is api://app1ClientId and the scp is user_impersonation like below:

enter image description here

3
  • Can you access app1 with this token now ?
    – Madfish
    Nov 29, 2022 at 9:46
  • Yes, I am able to access the app1 with the above generated token.
    – Rukmini
    Nov 29, 2022 at 9:48
  • 1
    Ok, I probably have a configuration problem on AD, thx for your help
    – Madfish
    Nov 29, 2022 at 10:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.