search

AzureADQuickStarts / AppModelv2-WebApp-OpenIDConnect-DotNet

ASP.NET Web Server - OpenID Connect v2 Endpoint Sample
Apache License 2.0
96 stars 91 forks source link

unable to sign in with Microsoft personal account #1

Closed stefann42 closed 6 years ago

stefann42 commented 8 years ago

Compiled, configured, and ran sample. Trying to sign in with a Microsoft (personal) Account and the flow ends up in this error from login.live.com: error=unsupported_response_type error_description=The provided value for the input parameter 'response_type' is not allowed for this client. Expected value is 'code'.

It seems like the OpenID Connect flow isn't supported for Microsofts (personal) accounts?

bobbywallace commented 7 years ago

Did you ever receive a fix for this problem?

josemanuelsh commented 7 years ago

I just had this problem, and found this issue while searching.

I finally found the answer. Apparently you just need to check the "Allow Implicit Flow" setting under Platforms in the App Edit Page. That did the trick for me.

I hope this helps someone in the future.

colgreen commented 4 years ago

Right, however, the 'implicit flow' options have this text alongside them in the AzureAD settings window...

Checking Access tokens and ID tokens is recommended only if the application has a single-page architecture (SPA), has no back-end components, does not use the latest version of MSAL.js with auth code flow, or it invokes a web API via JavaScript.

I.e. we are being advised not to use it for an app with a backend server available. But then it finishes with:

ID Token is needed for ASP.NET Core Web Apps.

Which to me seems to contradict the first section of the paragraph!

I think this may just be out of date text. I suspect the implicit flow used to be necessary, but ASP.NET Core and Katana now support the 'code flow', so the demo and this text possibly/maybe just need updating.

joeflack4 commented 3 years ago

Apparently this is only available under 'Manifest' now. I don't see any UI otherwise in Azure to enable.

jmprieur commented 3 years ago

@stefann42 which audience did you choose when creating your app? See https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app#register-an-application. If you choose Accounts in any organizational directory and personal Microsoft accounts, this should work (with tenant = common)