Search code examples
azureoauth-2.0postmanazure-api-management

Azure api OAuth2 implicit flow works on http but not on htt

I created an Api in azure and recently tried to change to authentication method to access it via OAuth2.

I requested a token using https://login.microsoftonline.com/[TENANT]/oauth2/v2.0/token/ and tried to use it to access my api via postman.

enter image description here

Then I tried to use the received token to make a request to my api: I used Postman's Authorization pane to specify OAuth2.0 as the authentication method and set the Grant Type configuration to "implicit" and sent a request.

enter image description here

Configured like this, the request goes through using the "http" version of my api but as soon as I try to use the "https" version, I get a 401 error "Unauthorized".

Have I configured my api wrong ? Or am I using the wrong url to authenticate ?

Thanks a lot for your time.

Solution

  • After a lot of research I found out what was wrong :

    1. I had to add the application ID in the allowed token audiences of identity provider (in the azure app service, navigate to authentication > locate the identity provider > click on edit > at the bottom of the page add the your app registration's application ID. For good measure I also added api://[APPLICATION ID]/.default and api://[APPLICATION ID]

    2. There was still some authentication code left in the source code of my api. When I was trying to connect I sometime had a response which consisted of HTML titled "Sign in to your account". It was caused by a segment of code in the startup.cs file of my api which verified the user who made the request against my Azure AAD. After removing it I no longer had the error