Issue with jwt-bearer on-behalf-of grant in Azure AD

Question

So I have an Angular app that uses the adal-angular library to authenticate with an ASP.NET Core 2.0 Web API. The API then uses on-behalf-of flow to authenticate with another API using the users token like this MS article https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-on-behalf-of.

The issue I have is this is working fine in the DEV environment but I have now deployed a TST environment with separate App Registrations and I am receiving the following exception when I try and request the token using on-behalf-of

AADSTS240002: Input id_token cannot be used as 'urn:ietf:params:oauth:grant-type:jwt-bearer' grant.

The code I am using to request the token

public async Task<string> AcquireTokenAsync(string resource)
    {
        try
        {
            string accessToken = await _httpContextAccessor.HttpContext.GetTokenAsync(AuthenticationConstants.AccessToken);

            var credentials = new ClientCredential(_azureOptions.ClientId, _azureOptions.ClientSecret);
            var authContext = new AuthenticationContext($"{_azureOptions.Instance}{_azureOptions.TenantId}")
            {
                ExtendedLifeTimeEnabled = true
            };

            // On-behalf-of auth token request call
            var authResult = await authContext.AcquireTokenAsync(
                resource,
                credentials,
                new UserAssertion(accessToken));

            return authResult.AccessToken;
        }
        catch (AdalServiceException asex)
        {
            _logger.LogError(asex, $"Instance: {_azureOptions.Instance} Tenant: {_azureOptions.TenantId} ClientId: {_azureOptions.ClientId}");
            throw;
        }
        catch (System.Exception ex)
        {
            _logger.LogError(ex, ex.Message);
            throw;
        }
    }

And I have used Fiddler and it looks like all the correct parameters are being passed.

Any help would be very much appreciated. I have set knownClientApplications on the second API and I have granted permissions on the Angular backend API to the second API.

Answer 1

According to your question and the error, it should be caused by that you angular app is not a Native(public) app.

For using this OBO flow with this Grant type, your client must be a public client not credential client.

If you want to register your client as a WebApp/API, you can refer to this Implementation:

Hope this helps!

---

Update

According to OP's comment, he/she got it working by changing oauth2AllowImplicitFlow from false to true.