OAuth2 Implicit flow

[IntranetFactory]

It seems that the implicit flow isn't implemented. Do you have any plans to add that as well? That just became a blocker for our pm migration.

[AnWeber]

Currently, the implicit flow is not implemented. It would be helpful if you give me a description, how this is used (response_code id_token vs. token). In my current environment, I do not use this flow. I need to build up a valid test.

[IntranetFactory]

Implicit flow doesn't use the secret, provide only an access_token (but no refresh token). I'll prepare some information what should probably be added/changed to support it.

[IntranetFactory]

I think it's enough to change the response type to token e.g. https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=token&state=dev&client_id=0c1d9732-466e-458f-85d7-260e448831a8&scope=openid%20profile%20email%20User.Read&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcallback. After sign in a redirect to http://localhost:3000/callback#access_token=XXX&token_type=Bearer&expires_in=3599&scope=email+openid+profile+User.Read&state=dev&session_state=beacc8af-a36a-46f7-bf0e-3d255d2ea83d happens (where xxx is the opaque token value). The parameters are provided after the # so they are not send to the server. I think that adding an AJAX request to the page /callback sending the hash parameters to the extension server should be enough to support the implicit flow.

The token can then be send in the Bearer header to request e.g. GET https://graph.microsoft.com/v1.0/me

I've setup an AAD Test App

local_authorizationEndpoint=https://login.microsoftonline.com/common/oauth2/v2.0/authorize
local_tokenEndpoint=https://login.microsoftonline.com/common/oauth2/v2.0/token
local_clientId=0c1d9732-466e-458f-85d7-260e448831a8
local_scope=openid profile email User.Read

From my understanding it's secure to share that information, as it only allows an user to request a token for this own account. I don't need to share the secret, and there is no risk to loose the related refresh token.

[AnWeber]

I released a new version with implicit flow. Can you please test.

[IntranetFactory]

Great work, from my pov oauth2 support is now perfect.