How to implement authorization_code grant flow in golang to login to Azure AD

user_2091663 0
Viewed 1313

I would like to implement authorization grant flow for an application in golang. The app will then read (delegated) azure resources the user has access to.

Already combed through several dozens of samples in github and everywhere else, but they are either incomplete or doesn't bring up the login prompt as expected.

I am looking for a sample that uses purely REST (preferable). If not, using adal/msal, "golang.org/x/oauth2/microsoft" or any other method. Also need to get an access token from the request as the Go sdk for Azure doesnt cover all resources and I'd like to use the access token to make REST calls.

enter image description here

Any pointers to working code sample would be highly appreciated. Note: I can successfully login with other methods like client credentials. Issue is only getting auth code flow to work.

Thank you.

azure-ad-graph-api azure-active-directory go azure
1 Answers

Thank you for reaching out. As you have noted, the Azure SDK for Go does not yet support the authorization code flow. You should be able to use the authorization code flow by following these steps:

  1. Request an authorization code by directing the user to the /authorize endpoint making sure to add the offline_access scope. If successful, the authorize endpoint returns the authorization code.
https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize?
client_id=6731de76-14a6-49ae-97bc-6eba6914391e
&response_type=code
&redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F
&response_mode=query
&scope=openid%20offline_access%20https%3A%2F%2Fgraph.microsoft.com%2Fmail.read
&state={state}
&code_challenge={code_challenge}
&code_challenge_method=S256
  1. Redeem the authorization code for an access token using either a client_secret or a certificate credential. If successful, the token response will include an access_token and a refresh_token which is used to fetch access tokens after the current one expires.
POST /{tenant}/oauth2/v2.0/token HTTP/1.1
Host: https://login.microsoftonline.com
Content-Type: application/x-www-form-urlencoded

client_id=6731de76-14a6-49ae-97bc-6eba6914391e
&scope=https%3A%2F%2Fgraph.microsoft.com%2Fmail.read
&code=OAAABAAAAiL9Kn2Z27UubvWFPbm0gLWQJVzCTE9UkP3pSx1aXxUjq3n8b2JRLk4OxVXr...
&redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F
&grant_type=authorization_code
&code_verifier=ThisIsntRandomButItNeedsToBe43CharactersLong 
&client_secret={client_secret}    // NOTE: Only required for web apps. This secret needs to be URL-Encoded.
  1. Use the access token to make requests such as getting the signed-in user's messages:
GET /v1.0/me/messages
Host: https://graph.microsoft.com
Authorization: Bearer {access_token}
  1. Refresh the access token by submitting another POST request to the /token endpoint, this time providing the refresh_token:
POST /{tenant}/oauth2/v2.0/token HTTP/1.1
Host: https://login.microsoftonline.com
Content-Type: application/x-www-form-urlencoded

client_id=535fb089-9ff3-47b6-9bfb-4f1264799865
&scope=https%3A%2F%2Fgraph.microsoft.com%2Fmail.read
&refresh_token={refresh_token}
&grant_type=refresh_token
&client_secret={sampleCredentials}   // NOTE: Only required for web apps. This secret needs to be URL-Encoded

Please see additional documentation here to learn more about error handling and refreshing the token: authorization code flow

Let me know whether this helps and if you have further questions.

user_110830340
Related