使用 Oauth 对 Onedrive 进行身份验证的问题？

Question

I am trying to authenticate to Onedrive using the OAuth Token flow process. So basically the user enters their clientid, client secret and then they are redirected to the Microsoft Login screen to authenticate and receive an access token. I have done the following:

    public async Task GetTokenAsync(string tenant, string clientId, string clientSecret)
    {

        HttpResponseMessage resp;
        ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12;
        HttpClient httpClient = new HttpClient();
        httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/x-www-form-urlencoded"));
        var req = new HttpRequestMessage(HttpMethod.Post, $"https://login.microsoftonline.com/{tenant}/oauth2/token/");
        req.Content = new FormUrlEncodedContent(new Dictionary<string, string>
            {
            {"grant_type", "client_credentials"},
            {"client_id", clientId},
            {"client_secret", clientSecret},
            {"resource", "https://graph.microsoft.com"}                
            });
        try
        {
            resp = await httpClient.SendAsync(req);
            string content = await resp.Content.ReadAsStringAsync();
            var jsonObj = new JavaScriptSerializer().Deserialize<dynamic>(content);
            string token = jsonObj["access_token"];
        }
        catch (Exception ex)
        {

        }

The issue is I want the Microsoft login screen to pop up and the user logs in , once they have been authenticated then the access_token can be extracted. The process above that I am doing doesnt seem to allow that , what am i doing wrong here ?

Answer 1

There are a few things I see amiss here.

1. If you are looking at user authentication, the client credentials flow is an incorrect approach. Your users are not clients. Clients are applications that talk to your identity server. Their secrets are supposed to be secrets.
2. If you are initiating a client credentials flow through a web browser, you are bound to hit a CORS error as most identity providers do not allow cross-domain calls to their token endpoints.
3. If you are looking to implement user authentication, look into the implicit grant flow[1], or the more secure PKCE flow in OAuth. Microsoft provides libraries[2] to assist you here.

References:

[1] https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-implicit-grant-flow

[2] https://developer.microsoft.com/en-us/identity/blogs/msal-js-2-0-supports-authorization-code-flow-is-now-generally-available/