如何从客户端机密和开放ID令牌获取访问令牌

Question

I have a javascript app as my client side app which communicates with a backend server for information. They are decoupled so when the user logs in there isn't any authentication communication between the server and the client.

I am trying to setup the server so that I can pass the open id token to the server then have the server redeem the open id token against https://login.microsoftonline.com/common for an access token.

I have gotten this to work using a certificate (code below) however I cannot seem to get it to work by using a client secret.

var authority = "https://login.microsoftonline.com/common";

// Construct client assertion certificate
var clientAssertionCertificate = new ClientAssertionCertificate("<client_id", certificate);

var context = new AuthenticationContext(authority);

// User Assertion
var userAssertion = new UserAssertion(id_token);

authenticationResult = await context.AcquireTokenAsync("https://graph.microsoft.com", clientAssertionCertificate, userAssertion);

When I change this out for a client secret it no longer works.

var authority = "https://login.microsoftonline.com/common";

// Construct client assertion
var clientAssertion = new ClientAssertion("<client_id>", "<client_secret>");

var context = new AuthenticationContext(authority);

// User Assertion
var userAssertion = new UserAssertion(id_token);

authenticationResult = await context.AcquireTokenAsync("https://graph.microsoft.com", clientAssertion, userAssertion);

Looking at the documentation on the constructor of ClientAssertion is says: "Constructor to create credential with a jwt token encoded as a base64 url encoded string." And the assertion is: "The jwt used as credential.". This makes me think that the client assertion needs to be an actual json web token. Am I missing something here? Do I need to actually create/get a JWT from my client secret in order to get an access token from the id token?

Thanks for the help.

Answer 1

The JWT Bearer grant type is used when the client wants to receive access tokens without transmitting sensitive information such as the client secret ,we usually use that as an alternative for a client secret in an Authorization Code grant. This can also be used with trusted clients to gain access to user resources without user authorization. Please read more about jwt bearer from here .

And usually this assertion type is used to obtain an access token for a downstream service, from an access token presented by a native client. (See here for an example: https://github.com/AzureADSamples/WebAPI-OnBehalfOf-DotNet ). You could also click here for Authentication Scenarios for Azure AD.