Azure AD returns non JWT Tokens when exchanging the OAuth2 code for an access token

Question

I have an Azure AD App on my tenant that is configured to accept multiple tenants AND personal accounts.

I follow the procedure to retrieve an AccessToken as explained here: https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow

When I receive the "code" in my app from the Microsoft web page, I exchange it for an access token calling the endpoint "https://login.microsoftonline.com/common/oauth2/v2.0/token".

Here the behavior differs whether the user that logs in is a work account or a personal account.

With work accounts, I receive a normal JWT Token and everybody is happy: I can decode the token and read the claims.

With personal accounts, I receive another token, that is not a JWT Token and I don't have any clue on how to:

1. validate this token
2. read a few information from the user (specifically, the email of the user)

Could you please help me understand how to perform these two actions?

NOTE: I have seen the answers here: Microsoft as OAuth2 provider for personal accounts does not issue JWT access tokens but my case is slightly different, since I don't want to access MS Graph with this token, I just need to retrieve the email of the user.

Thanks!

cghersi

Agnomen

Answer 1

The access_token in OAuth2 is not required to be an JWT per the OAuth specification.
However Microsoft supports OpenID Connect, that provides an id_token. The id_token is always an JWT.

To "upgrade" your OAuth request to an OpenID Connect request you simply have to add the scope openid (and possibly email to ensure you get an email).
Then when you exchange your code to an access_token you also get an id_token

Pennington

Thanks @Nisd, I can get the id_token, but it has no relevant claims for me to find the email of the user (even if I put the email scope). So, is there a MS REST API that I can call with the id_token to retrieve the basic details of the user, like the email? – Agnomen

@CristianoGhersi Sounds strange. Looking at our own codebase we are able to extract email and name from the id_token. In the Azure Portal, have you tried adding email and openid as requested claims by your application? Alternatively you should be able to call the UserInfo endpoint at graph.microsoft.com/oidc/userinfo with your access_token. – Pennington

How does the example for delegated access in postman get the JWT then, it looks like it follows the exact same flow for generating a code, and token – Kryska

Off-topic: seeing the words "OpenID" and "upgrade" in a single sentence makes me chuckle... isn't OpenID the "old" piece of tech (heck, the spec was drafted in 2005!), that was superseded by OAuth2? – Procora

@Procora Yes, OpenID is old and was replaced by OAuth2. However OpenID Connect is new and build on-top of OAuth2. – Pennington