'Missing access token under ./auth/me using Easy Auth
I'm creating an Azure Static Web App with the built-in (Easy Auth) authorization to the Azure AD. This works well, but I would also like to authorize access to user-specific data in another API (AWS, but I have registered also this as an app in Azure AD). My thought was to do this with an access token, but heading to the /.auth/me
only gives me the following information:
identityProvider
userId
userDetails
userRoles: [ "authenticated", "anonymous" ]
claims: aud, iss, iat, nbf, exp, aio, c_hash, name, nonce, .../objectidentifier, preferred_username, rh, .../nameidentifier, .../tenantid, uti, ver
The available cookies are: AppServiceAuthSession
. AppServiceAuthSession1
and StaticWebAppsAuthCookie
I have set "accessTokenAcceptedVersion": 2
in the Azure AD app, as well as
enabling both access and id tokens.
My staticwebbapp.config.json
has this in it (with <TENANT_ID> and <API_AD_APP> replaced) :
"identityProviders": {
"azureActiveDirectory": {
"registration": {
"openIdIssuer": "https://login.microsoftonline.com/<TENANT_ID>/v2.0",
"clientIdSettingName": "AZURE_CLIENT_ID",
"clientSecretSettingName": "AZURE_CLIENT_SECRET"
},
"login": {
"loginParameters": [
"scope=openid profile email offline_access api://<API_AD_APP>/user_impersonation",
"response_type=code id_token"
]
}
}
}
},
In the API app AD I have set added the user_impersonation
scope under "Expose an API", and authorized my main AD app to use it.
Is it possible to get hold of the access cookie this way, or do I have to switch to requesting it using MSAL instead?
EDIT:
There is now an issue about enabling this functionality:
https://github.com/Azure/static-web-apps/issues/794
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
Solution | Source |
---|