Following the guide here: Web sign-in with OpenID Connect -> Get A Token.
I'm trying to make a post request to access a token,
HTTP POST: url: https://login.microsoftonline.com/[az-directory].onmicrosoft.com/oauth2/v2.0/token?p=B2C_1_SiUpIn
Post Body:
client_id: [client_id for Azure Function App]
grant_type: authorization_code
scope: https://[url-to-azure-app-api-endpoint] openid offline_access
code: [code retrieved from login url]
redirect_uri: http://[redirect-uri-used-in-login]
client_secret: [secret client id in azure functions]
My response is:
{
id_token:...
token_type:...
not_before:...
id_token_expires_in:...
profile_info:...
refresh_token:....
refresh_token_expires_in:...
}
None of the request body is an access_token despite the link saying that's what I would get.
I'm not sure how to proceed from here, is it possible I'm missing some sort of permission between my Azure AD B2C app and the Functions App it's meant to secure?
edit: upon further investigation I found the following:
The login url you use affects what the resulting code token you get can do (makes sense), I'm trying something like:
https://login.microsoftonline.com/[ad directory name].onmicrosoft.com/oauth2/v2.0/authorize?p=B2C_1_B2C&client_id=[client_id]&nonce=defaultNonce&redirect_uri=http://localhost:3000&scope=https://[api uri] openid offline_access&response_type=code+id_token&prompt=login
With the resulting code if I make a post request to the token endoint as described above I get a refresh token and an ID token.
However I also found that I don't need to send all the post parameters per the link, I get away with just passing grant_type, code and client_secret. Since the login call seems to actually control the scope of what you can access with the authorization code it returns this sort of makes sense but I'm not sure why the link above says you need to pass client_id, scope and redirect_uri.
I can use the id token from this post request as an authorization bearer token to pass into my azure functions app and I can use the refresh token to call into the refresh token endpoint to refresh the id token which I can grab from the result and continue to use in my azure functions app.
So my question becomes: Is this acceptable? Why are my findings so much different to what the link above says should be possible? Do I need an access token at all anymore?
