I have two different Registration Apps on Azure AD and I would like App 2 to be able to impersonate a user of App 1. My 2 apps belong to the same tenant. I added in the permissions of App 2 the scope user_impersonation (see picture).
Then I created an express server with passport in order to realize the oauth.
const app = express()
passport.use("my-strategy", new MicrosoftStrategy({
clientID: "my-client-id",
clientSecret: "my-client-secret",
callbackURL: "http://localhost:3000/auth/microsoft/callback",
tenant: "my-tenant-id",
}, function (accessToken: string, refreshToken: string, params: any, profile: any, done: any) {
try {
let user = {
accessToken: accessToken,
refreshToken: refreshToken,
}
console.log(user);
} catch (error) {
console.log('error on login');
console.log(error)
return done(error)
}
}));
app.use(passport.initialize());
app.get('/', (req, res) => {
res.send("Express Server")
});
app.get('/auth/microsoft/login',
passport.authenticate('my-strategy'));
app.get('/auth/microsoft/callback',
passport.authenticate('my-strategy', { failureRedirect: '/failure' }),
function (req, res) {
res.redirect('/success');
});
app.get("/success", (req, res) => {
res.send("Success");
});
app.get("/failure", (req, res) => {
res.send("Failure");
});
app.listen(3000, () => {
console.log("Server running on 3000");
})
No problem so far, I can make my request and get an access token and a refresh token. By looking at the content of the access token I have the scope "user_impersonation".
The problem occurs when using this token. It is impossible for me to access the App 1 with this token.