acquireTokenRedirect Fails with error AADSTS700023 (invalid openid and profile scopes)

[PoyaManouchehri]

Hello, I'm running into a problem that seems very much the same as #135 . In short:

1. We have an app registered in AAD. The oauth2AllowImplicitFlow setting in the manifest is set to true.
2. We use the AppId as the "Audience" when configuring the bearer token middleware in our API.
3. The client (using MSAL.js) we first call .login with the scope set to AppId. This successfully gets us an id token.
4. Subsequently, at a later point we call acquireTokenRedirect() again passing the AppId as the only scope. This generates an authorize?response_type=token, however requests openid and profile scopes which are apparently incompatible with the access token response type.
5. We get this error on screen:
   AADSTS700023: The provided value for the input parameter scope 'openid profile' is not valid when requesting an access token. Please specify a valid scope.

Any help would be really appreciated. #135 seems to indicate there was a fix related to the issue at some point but I'm still seeing it in version 0.1.7.

Thanks

[danieldobalian]

@PoyaManouchehri why do you want to get an access token? Are you trying to authorize the user to call an API on their behalf?

The scopes openid and profile do not map to any resource (they're used for pure sign in a.k.a OpenID Connect), so the token service doesn't know what audience to mint the access token for. If you need an access token for the Microsoft Graph for example, you would add the scope User.Read.

This doc has more info.

[PoyaManouchehri]

@danieldobalian thanks for your response. A couple of notes:

1. I secure my own API (an ASP.NET Core based API). My understanding of OAuth/OpenID is that I should be using access tokens for accessing an API rather than the ID token which should be used in my client (in this case an Angular 5 SPA). I use the AddJwtBearer middleware in my backend and set the Audience to be my AppID.

2. I understand that openid and profile are not resources, which is why it surprises me that the acquireTokenRedirect call is including them in the scopes, when I just specify the scope to be the AppID.

[rohitnarula7176]

@PoyaManouchehri The issue is now fixed in the dev branch and will be part of our next release. Closing this issue for now. Please test with the dev branch and confirm if it is resolved for you.