如何为Microsoft OAuth2提供程序的Native应用程序指定localhost loopback redirect_uri？

Question

I have the code which authorizes at https://login.live.com/oauth20_authorize.srf endpoint.

Parameters of the call: "client_id=" + ClientID + "&scope=" + someScopes + "&response_type=code&redirect_uri=" + WebUtility.UrlEncode(" http://localhost:some-port/signin-microsoft ")

http://localhost:port/signin-microsoft is registered as one of Redirect URLs in my app at https://apps.dev.microsoft.com (I had to use Add Platform -> Web to put this redirect_url there).

I run HttpListener (local web server in the app) to intercept the authorization code. Then I get the code and pass it to this endpoint:

https://login.live.com/oauth20_token.srf

Parameters of the call: "client_id=" + ClientID + "&code=" + code + "&grant_type=authorization_code&redirect_uri=" + WebUtility.UrlEncode(" http://localhost:some-port/signin-microsoft ")

This fails because ClientSecret is missing. If I add ClientSecret, it works and I get the access and refresh token.

However, native apps should not store and send OAuth2 client secrets. ClientSecret is required for web apps only.

Now's the problem. apps.dev.microsoft.com portal does not let me specify localhost redirect_uri for Native apps. I can do this for web apps only (in Web / Redirect URLs section). With Native apps, trying to specify any URI always results in "Your URI must be in the format of {scheme}://{domain}/{path}, have no query string parameters, and be limited to 255 characters." message.

I seems that only a few predefined values are allowed there (such as https://login.live.com/oauth20_desktop.srf ). Even if I add or change any single char in this value, it's no longer valid and the portal does not let me save the changes. I can these predefined values only if I don't have localhost-based redirect_uri. This means I have to use the complex methods of obtaining the authorization code (monitoring browser processes and so on) instead of a simple HttpListener (which is used by Google OAuth2 provider, for instance).

Is there a way to use localhost as redirect_uri and still not send ClientSecret, when working with Microsoft OAuth2 provider?

And why can't I specify other URLs in Native Application / Custom Redirect URIs of apps.dev.microsoft.com portal? What's the purpose of this form if I anyway can't add any values except of those predefined ones which are already there?

Again, I have no issues adding my custom URL to Web / Redirect URLs on the same page (and everything's working fine then, it's just that I need to deal with ClientSecret which I don't want to).

Answer 1

you're supposed to register a loopback Url invoked by the browser, such as http://127.0.0.1:8000

Also your code should use the PKCE variation of the Authorization Code Flow - to avoid client secrets

I've not used it with Azure but pretty certain this will work for you

Some gory details on my blog about this: https://authguidance.com/2018/01/17/desktop-app-how-to-run-the-code-sample/

Native apps and OAuth are tricky - so happy to help - feel free to ping me any follow up questions

Answer 2

OK, the URL which can be added as Custom Redirect URI in Native Application section of apps.dev.microsoft.com portal must look like something.not.http.or.https://something

Eg:

pw.oauth2://oauth2redirect

This kind of a URI is allowed there (where pw.oauth2 is a URL scheme associated with your app, such as, for UWP applications, Package Manifest / Declarations / Protocol / Name). It's not exactly localhost loopback but this lets your app be triggered by the browser to intercept the authorization code. And ClientSecret is not needed.

If found the working example (for Google provider) at https://github.com/googlesamples/oauth-apps-for-windows/tree/master/OAuthUniversalApp and was able to adapt it for Microsoft provider with no issues.