benbaran / adal-angular4

Angular 4/5/6/7 ADAL Wrapper
MIT License
86 stars 104 forks source link

Endpoint is not called by ADAL, instead only token is returned #53

Closed web265p3 closed 6 years ago

web265p3 commented 6 years ago

For this issue I created a new Angular6-app with angular cli, that tries to call my backend API with a token retrieved from the oauth-endpoint.

My source code can be found here: https://github.com/web265p3/angular-adal-test/tree/master/src

I installed the latest version of adal-angular4 and configured everything like I found in the tutorials. I call my API with the following lines:

    this.http
    .get(`${environment.adalConfig.apiUrl}authentication3`, this.prepareOptions())
    .pipe(
    map((r: any) => {
        return r;
    })).subscribe(a => {
    }, r => {
    });

The prepare options, just adds the token:

prepareOptions(): any {
    let httpHeaders = new HttpHeaders();
    httpHeaders = httpHeaders
        .set('Content-Type', 'application/json')
        .set('Authorization', `Bearer ${this.adalService.userInfo.token}`);
    return { headers: httpHeaders };
}

But a URL with "authentication3" as suffix is never even called. Instead I can find a token, that is returned to my app via an HTTP 302 redirect.

https://login.microsoftonline.com/2ef09b02-2e8f-4181-8bb2-78cfc813799a/oauth2/authorize?response_type=token&client_id=197214be-be8d-4ba1-bdb5-f231ff06bb02&resource=https%3A%2F%2Fmydomain-api.azurewebsites.net&redirect_uri=http%3A%2F%2Flocalhost%3A4200%2F&state=90a7cba4-0370-4ba4-be44-7857b9dfb5a1%7Chttps%3A%2F%2Fmydomain.azurewebsites.net&client-request-id=84e96d07-a7a9-4ec5-956b-c980d3dc1aca&x-client-SKU=Js&x-client-Ver=1.0.17&prompt=none&login_hint=user.name%40tenantname.onmicrosoft.com&domain_hint=tenantname.onmicrosoft.com

The location header redirects me to localhost:4200 with a valid access token. But ADAL does neither take the token, nor calls my endpoint. It just happens nothong.

I enabled adal verbose logging and get the following output:

Wed, 23 May 2018 12:07:08 GMT:1.0.17-INFO: renewToken is called for resource:https://mydomain-api.azurewebsites.net app.component.ts:21 Wed, 23 May 2018 12:07:08 GMT:1.0.17-INFO: Add adal frame to document:adalRenewFramehttps://mydomain.azurewebsites.net app.component.ts:21 Wed, 23 May 2018 12:07:08 GMT:1.0.17-VERBOSE: Renew token Expected state: 90a7cba4-0370-4ba4-be44-7857b9dfb5a1|https://mydomain.azurewebsites.net app.component.ts:21 Wed, 23 May 2018 12:07:08 GMT:1.0.17-INFO: Navigate url:https://login.microsoftonline.com/2ef09b02-2e8f-4181-8bb2-78cfc813799a/oaut…d=84e96d07-a7a9-4ec5-956b-c980d3dc1aca&x-client-SKU=Js&x-client-Ver=1.0.17 app.component.ts:21 Wed, 23 May 2018 12:07:08 GMT:1.0.17-VERBOSE: Set loading state to pending for: https://mydomain.azurewebsites.net app.component.ts:21 Wed, 23 May 2018 12:07:08 GMT:1.0.17-INFO: LoadFrame: adalRenewFramehttps://mydomain.azurewebsites.net app.component.ts:21 Wed, 23 May 2018 12:07:09 GMT:1.0.17-INFO: Add adal frame to document:adalRenewFramehttps://mydomain.azurewebsites.net app.component.ts:21 Wed, 23 May 2018 12:07:09 GMT:1.0.17-INFO: LoadFrame: adalRenewFramehttps://mydomain.azurewebsites.net app.component.ts:21 Wed, 23 May 2018 12:07:09 GMT:1.0.17-INFO: Add adal frame to document:adalRenewFramehttps://mydomain.azurewebsites.net app.component.ts:21 Wed, 23 May 2018 12:07:12 GMT:1.0.17-VERBOSE: State: 90a7cba4-0370-4ba4-be44-7857b9dfb5a1|https://mydomain.azurewebsites.net app.component.ts:21 Wed, 23 May 2018 12:07:12 GMT:1.0.17-INFO: State status:false; Request type:LOGIN

I am out of ideas, what might go wrong here. Why is ADAL just ignoring my call to the "authentication3" route. Any proposals?

web265p3 commented 6 years ago

Problem fixed! This issue describes what was wrong. It was the adal version 1.0.17, that contained a bug.

https://github.com/benbaran/adal-angular4/issues/32

sonphnt commented 6 years ago

@web265p3 with adal version 1.0.17 and Angular 6. Can you get accessToken correctly? How did you fix that? I only get IdToken and manually get accesstoken by another call.