<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

I think I answered my own question... It looks like tokens tha

Microsoft OAuth Question about Access Token about nuxt-auth-utils HOT 2 CLOSED

atinux commented on July 20, 2024

Microsoft OAuth Question about Access Token

from nuxt-auth-utils.

Comments (2)

OliverMartini commented on July 20, 2024

I think I answered my own question...

It looks like tokens that are used to access the MS Graph API do not include any custom scopes.
Custom APIs require the token to include the scope defined in the API application.
Therefore two tokens are required in that scenario.

For now, I solved by using @azure/msal library to get an apiAccessToken in the server/routes/auth/microsoft.get.ts call

import * as msal from '@azure/msal-node'

async function acquireAPITokenByRefreshToken(refreshToken) {
  const authority = `https://login.microsoftonline.com/${process.env.NUXT_OAUTH_MICROSOFT_TENANT}`
  const config = {
    auth: {
      clientId: process.env.NUXT_OAUTH_MICROSOFT_CLIENT_ID || '',
      authority,
      clientSecret: process.env.NUXT_OAUTH_MICROSOFT_CLIENT_SECRET || '',
      knownAuthorities: [authority],
    },
    system: {
      loggerOptions: {
        loggerCallback(loglevel, message, containsPii) {
          console.log(message)
        },
        piiLoggingEnabled: false,
        logLevel: msal.LogLevel.Error,
      },
    },
  }
  const cca = new msal.ConfidentialClientApplication(config)

  return cca.acquireTokenByRefreshToken({
    scopes: [`api://${process.env.NUXT_OAUTH_MICROSOFT_CLIENT_ID}/access_as_user`],
    refreshToken,
  }).catch((err) => console.log(err))
}

export default oauth.microsoftEventHandler({
  config: {
    scope: ['openid', 'offline_access', 'profile', 'User.Read',], // USE AN ARRAY FOR YOUR SCOPES
  },
  async onSuccess(event, { user, tokens }) {
    const apiAccessDetails = await acquireAPITokenByRefreshToken(tokens.refresh_token)
    await setUserSession(event, {
      user,
      loggedInAt: Date.now(),
      graphAccessToken: tokens.access_token,
      apiAccessToken: apiAccessDetails?.accessToken
    })
    console.log('User logged in')

    return sendRedirect(event, '/')
  }
})