microsoftonline authorize enddpoint does not let my User authorize the app but skips straight to 302

John Jacko 21 Reputation points
2022-05-10T03:25:10.79+00:00

I'm trying to set up a Server Application and an Angular Client Application to co with it. My goal is to have the back end service manage information regarding users in an Azure Active Directory tenant.

Currently, a given flow is able to go something like this:

  1. New User Fills out a form for creating an account
  2. Upon Submission, the client sends the data to the server, which uses the Graph API to generate a new User under the given tenant.
  3. The Service randomly generates a state value and returns it to the Angular Client.
  4. The Angular Client takes the state value and redirects to https://login.microsoftonline.com/${environment.user_tenent_id}/oauth2/v2.0/authorize ... with all the required information
  5. The Microsoft endpoint immediately returns a 302 with a code directing the User back to the Angular Client (thus not giving the user the opportunity to go though the consent and login page)
  6. The Angular Client detects the state and code and sends these values to the service to access the token
  7. The Service is told "AADSTS65001: The user or administrator has not consented to use the application with ID '<app_id_here>' named 'TrecApps-User-Test'. Send an interactive authorization request for this user and resource" (because the User was never given the opportunity to "consent")

What SHOULD happen:

  1. New User Fills out a form for creating an account
  2. Upon Submission, the client sends the data to the server, which uses the Graph API to generate a new User under the given tenant.
  3. The Service randomly generates a state value and returns it to the Angular Client.
  4. The Angular Client takes the state value and redirects to https://login.microsoftonline.com/${environment.user_tenent_id}/oauth2/v2.0/authorize ... with all the required information
  5. The User is provided a consent page (and possibly login) before being redirected back to the Angular Client
  6. The Angular Client detects the state and code and sends these values to the service to access the token
  7. The Service retrieves token information and sends it back to the Angular Client. The User is now logged in and can look at his account.

Are there ways to ensure that either

  1. The User is presented with the consent page
  2. The Admin is able to provide this consent automatically so that AADSTS65001 does not happen. Evidently, specifying the relevant scopes at "Home" -> "Azure AD B2C" ->
    "[Registered App Name]" -> " | API Permissions "is not enough

?

Extra Information: The Server-Side app uses Spring Boot with a Spring Security Configuration tailored to use the com.microsoft.azure:azure-active-directory-spring-boot-starter to work with my tenant for OAuth2 Authentication.
The Relevant Scopes I'm currently looking at are "user.read openid profile offline_access"

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,606 questions
{count} votes