Azure-docs: Given that this is a server side app, why ID tokens under implicit flow has to be checked

[rameshjanjyam]

on app registration page it says to use implicit flow only for public client apps. This example builds a server side app, so why do we need to check ID tokens under implicit grant? Also in the code sample I see that no client secret is mentioned any where in the settings. how the app is still getting authenticated successfully when no client secret is provided. please clarify

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 479bff62-927a-9f71-c85f-4a1188c72bb2
• Version Independent ID: df934d01-7a9d-f7f9-d9ea-320454e32d77
• Content: Microsoft identity platform ASP.NET Core web app quickstart
• Content Source: articles/active-directory/develop/quickstart-v2-aspnet-core-webapp.md
• Service: active-directory
• Sub-service: develop
• GitHub Login: @jmprieur
• Microsoft Alias: jmprieur

[FrankHu-MSFT]

@rameshjanjyam Thanks for your feedback! We will investigate and update as appropriate.

[FrankHu-MSFT]

hello @rameshjanjyam can you clarify your ask? Are you asking for more clarification in regards to this document?

I suggest taking a look at the github repo's documentation as well : https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/

I agree though there are some items here that need to be taken a look at, and it can definitely be improved.

@jmprieur could you please help in regards to this matter?

[jmprieur]

Things seem to have changed. Looking at it

[fowl2]

On the App Registration part of the Azure portal, it warns against turning ID tokens:

Implicit grant
Allows an application to request a token directly from the authorization endpoint. Recommended only if the application has a single page architecture (SPA), has no backend components, or invokes a Web API via JavaScript. Learn more about the implicit grant flow

To enable the implicit grant flow, select the tokens you would like to be issued by the authorization endpoint:

[ ] Access tokens
[ ] ID tokens

This definitely needs to be explained.

[jmprieur]

ASP.NET Core needs the IDToken to evaluate the identity of the user, which is why IDToken is used. We are discussing about the portal UX which should not put IDToken in the implicit flow category (as obvisouly it can be used for other cases, like the Auth Code flow)

[jmprieur]

please-close

[DanielThomasHealy]

I apologize for bothering you @jmprieur , but I am trying to understand the distinction between IDToken and Implicit Grant Flow. Does enabling IDToken expose my application to the risks that led to the IETF deprecating the use of the Implicit Grant Flow, or do those risks only apply if I additionally enable access tokens?

Thank you for your time

[jmprieur]

@DanielThomasHealy it's perfectly ok to request an ID token. This is not the implicit flow in that case (even if the portal does present it as such as the moment. We are fixing this, BTW).
What we don't do is request an implicit flow access token (which would expose your application).

[baf]

@jmprieur It looks like the portal still presents it this way, and the manifest does as well (since the property is called oauth2AllowIdTokenImplicitFlow). Is there a timeline for this to be corrected? Failing that, or if it's faster, can some clarification also be added to the documentation at https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-implicit-grant-flow? Thank you!

[jmprieur]

@baf I don't know for the portal changes yet. But we've ensured that Microsoft.Identity.Web does not require the ID Token for Azure AD web apps calling web APIs (it's still needed for Azure AD B2C web applications calling web APIs)

This change will be Microsoft.Identity.Web 1.0.0 (GA version) which should be available before the end of the month. We'll change the quickstart as well.

cc: @mmacy @jennyf19 @henrik-me

[jmprieur]

please-reopen

[baf]

Thanks very much for the quick reply, @jmprieur!

[KalyanChanumolu-MSFT]

@jmprieur reopening this one

[jmprieur]

We're having a discussion with the portal to change the wording and making it clear that this is not implict flow, but hybrid flow. This is in the pipe. Proposing to close this issue, now.

please-close