Background: I am trying to get an angular SPA to work with a Postgrest API backend, using Azure Active Directory as the identity provider for getting a JWT. The test app works using Auth0 -- I am able to authenticate a user, get an access token, pass that token to the postgrest backend, it validates the token, checks the user's group and then allows access. My issue is when I switch out from Auth0 to Azure AD. To start with I've switched out the Auth0 code to MSFT's msal-angular library This works a little bit. I can secure a custom component with a guard. Navigation to the component prompts for an Azure AD login, and my test app successfully gets an identity token back. When I go hit the API backend the MSAL interceptor successfully puts a Bearer token into the headers -- though not a usable token as this is the identity token not the access token. My Question: According to the MSFT docs on using OAuth Implicit flow I need to set the response_type to both id_token and token. However I can not find any way in the MSAL for Angular documentation on how to do that. Is it possible? Continue reading...
