"id_token" is not present in Oauth2 token received from Microsoft login for some users.

ashutosh 5

I am using Microsoft as an Identity provider in my application. The problem is that I am not receiving "id_token" in Oauth2 token response even though I am requesting "openid" scope (scopes requested: openid profile email) everytime. For only one user it is working fine and for all the other users we are facing this issue.
I am using the common authorization and token endpoints: https://login.microsoftonline.com/common/oauth2/v2.0/authorize

Two factor authentication is enabled for the organisation in which the MS app is created. The Include ID Token in OAuth token option in the MS app is also enabled

ashutosh 5 Reputation points

2023-08-16T06:03:28.37+00:00

@Alfredo Revilla - Upwork Top Talent | IAM SWE SWA here is the fresh thread to track this issue.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,456 Reputation points

2023-08-16T06:07:58.8733333+00:00

Ok I got your HAR, will analyze it ASAP.
ashutosh 5 Reputation points

2023-08-18T06:23:08.1666667+00:00

Hi @Alfredo Revilla - Upwork Top Talent | IAM SWE SWA , did you get chance to look at the HAR file?
ashutosh 5 Reputation points

2023-08-23T07:45:44.3133333+00:00

Hi @Alfredo Revilla - Upwork Top Talent | IAM SWE SWA , one thing we observed is that for all the users where we are facing this error, they have 2 step authentication (Duo push) enabled for them. Following is the error thrown by our Identity and access management tool (keycloak): "message=Caused by: java.lang.RuntimeException: No identifier provider for identity.")
ashutosh 5 Reputation points

2023-08-23T07:50:01.6+00:00

Hi @Alfredo Revilla - Upwork Top Talent | IAM SWE SWA , one thing we observed is that for all the users for whom we are having this issue, they have two factor authentication (Duo push) enabled. Following is the error thrown by our Identity and Access Management tool (keycloak): "message=Caused by: java.lang.RuntimeException: No identifier provider for identity."
We suspect that this has something to do with the Oauth token being returned after two step authentication.

1 answer

ashutosh 5 Reputation points

2023-09-15T07:44:06.5133333+00:00

This was resolved by requesting for an additional scope "User.Read" apart from the basic scopes ("openid", "profile" and "email") during user authentication. It appears that this also depends on the AD settings of the organisation to which the user belongs. For some users the basic scopes were enough to get the id_token in OAuth2 token response, but for users belonging to some specific organisation "User.read" scope had to be added to get id_token in OAuth2 token response.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

"id_token" is not present in Oauth2 token received from Microsoft login for some users.

1 answer

Your answer