Howto login to Azure hosted and Active Directory p

Question

I am trying to login to my Java API backend app hosted in Azure and protected with Activty Directory.

In this article I read to make this call for receiving the token:

GET https://login.windows.net/developertenant.onmicrosoft.com/oauth2/authorize?response_type=id_token&client_id=aeadda0b-4350-4668-a457-359c60427122&redirect_uri=https%3A%2F%2Flocalhost%3A44326%2F&state=8f0f4eff-360f-4c50-acf0-99cf8174a58b&nonce=8b8385b9-26d3-42a1-a506-a8162bc8dc63 HTTP/1.1

But how to find out which state and which nonce to set for my own API backend app?

Just using the state and nonce from above example leads me to a response with a so called flowToken. Is this the type of token I have to send as also stated in the referred article? See this part:

Location: https://localhost:44326/#id_token=eyJ0eXAiOiJKV1QiLC[SNIP]gu1OnSTN2Q2NVu3ug&state=8f0f4eff-360f-4c50-acf0-99cf8174a58b&session_state=e4ec5227-3676-40bf-bdfe-454de9a2fdb2

I just would like to have a frontend app to securely connect to the backend app automatically without typing in user credentials.

Please do NOT tell me to use ADAL. Because that's what I already tried and what did not work. As you can see here.

Answer 1

As the authorization grand flow contains several url redirects, which is difficult to implement on SPA. You need to implement OAuth2 implicit grant flow in Azure Active Directory (AD) on client side by your own, which is also ADAL for JS done. You can refer to https://docs.microsoft.com/en-us/azure/active-directory/active-directory-authentication-scenarios#single-page-application-spa for more info about the work flow.

And the easiest way to go through the AAD in SPA is to use ADAL for JS. And according to your question Access to azure hosted API App denied by CORS policy, you can try to set the configuration of the AAD application which is protecting your backend server. I.E.

Try to use the client id in theEndpoints variable to set into the adalAuthenticationServiceProvider.init function. It works fine on my test project.

Any further concern, please feel free to let me know.