Wrong version of access token (expect V2 , received V1)

user_11761764 0
Viewed 932

I am trying to register users from the Azure Active directory using @azure/msal-angular, to be more precise I tried the following tutorial

Those are the changes I have made to the project

export function MSALInstanceFactory(): IPublicClientApplication {
  return new PublicClientApplication({
    auth: {
      clientId: 'my_real_client_id,
      redirectUri: 'http://localhost:4200',
      authority: 'https://login.microsoftonline.com/my_real_tenant_id',
      postLogoutRedirectUri: '/'
    },
    cache: {
      cacheLocation: BrowserCacheLocation.LocalStorage,
      storeAuthStateInCookie: isIE, // set to true for IE 11
    },
    system: {
      loggerOptions: {
        loggerCallback,
        logLevel: LogLevel.Info,
        piiLoggingEnabled: false
      }
    }
  });
}

  export function MSALInterceptorConfigFactory(): MsalInterceptorConfiguration {
  const protectedResourceMap = new Map<string, Array<string>>();
  protectedResourceMap.set('https://graph.microsoft.com/v1.0/me', ['user.read']);
  protectedResourceMap.set('http://localhost:5000/', ['profile']);

  return {
    interactionType: InteractionType.Redirect,
    protectedResourceMap
  };
}

The problem is that MsalInterceptor adds V1 token to the URL for the request to my API which expects V2.

Azure is configured to accessTokenAcceptedVersion: 2

I can provide more information if needed

Update

In my case, the problem was due to the scopes specified, both API for "user.read" and "profile" require V1 accessToken

msal-angular msal azure-active-directory
1 Answers

Although you have resolved the issue, I would like to clarify more details.

In fact it's not the permissions "user.read" and "profile" require V1 accessToken. The actual reason is that:

Access Tokens versions are determined by the configuration of your application/API in the manifest. You have to change the accessTokenAcceptedVersion part of the manifest to 2 if you want a V2 access token. This is also the reason why you cannot control what version of the access token you will get from your client application when you request an access token.

We can't modify the accessTokenAcceptedVersion from Microsoft Graph side.

So the conclusion is that an access token for MS Graph and those are always V1 access token.

user_105217390
Related