Microsoft-authentication-library-for-js: What is the correct string to use to identify a specific user in a local database?

[DarkLite1]

Library

• [x ] [email protected] from npm install msal

Documentation location

• [x] MSAL.js Github Wiki
• [x] README file
• [x] Documentation does not exist

Description

It's hard to find which identifier to use when a user authenticated to Azure AD. The returned object from msal.getAccount() contains multiple fields that can be used but it's unclear which one.

A similar question has been asked here and shows 2 possible options:

• accountIdentifier: combination of idToken.uid and idToken.utid
• idTokenClaims.oid

In the README it syas:

When the login methods are called and the authentication of the user is completed by the Azure AD service, an id token is returned which is used to identify the user with some basic information.

But the class account says the idToken will be deprecated soon:

export class Account {
    accountIdentifier: string;
    homeAccountIdentifier: string;
    userName: string;
    name: string;
    idToken: StringDict; // will be deprecated soon
    idTokenClaims: StringDict;
    sid: string;
    environment: string;

My single goal is to be store settings for the app in the database and find them back the next time the user signs-in. Thank you for clarifying which ID to use for this purpose.

[derisen]

I believe oid is what you need. From the documentation:

The immutable identifier for an object in the Microsoft identity system, in this case, a user account. This ID uniquely identifies the user across applications - two different applications signing in the same user will receive the same value in the oid claim. The Microsoft Graph will return this ID as the id property for a given user account. Because the oid allows multiple apps to correlate users, the profile scope is required to receive this claim. Note that if a single user exists in multiple tenants, the user will contain a different object ID in each tenant - they're considered different accounts, even though the user logs into each account with the same credentials. The oid claim is a GUID and cannot be reused.

[DarkLite1]

Thanks for the feedback @derisen . So the correct one to use is idTokenClaims oid

It might be beneficial to add this to the examples as a comment. So it's clear for developers which one they need to use. Given that there's no need to store a token in the app, because acquireTokenSilent calls will do that for us, the only remaining question can be on how to identify the user with a unique string. So therefore a small comment in the examples might be a good idea.

[derisen]

@DarkLite1 sounds good. I'm actually working on FAQ and will sure to add this.