twebauth-question/24157

[Alexander_Pastuhov]

In my last post in twebauth-question/24157 thread, before it was closed, I have asked some additional questions. Any feedback?

[Tunde (Tünde Keller)]

Hi,

@Alexander_Pastuhov

Next, it only returns a subset of user properties in the "UserData: TMicrosoftUserData" parameter, and does not have userPrincipalName value, which I need.

[...]

The data it gets from Azure includes businessPhones, jobTitle, mobilePhone, officeLocation, preferredLanguage and userPrincipalName, so it would make sense to return all of these.

Exposing the requested properties in TMicrosoftUserData is something we can do in a future version, when we have time to allocate on the component.

@Alexander_Pastuhov

And ideally the entire JWT as well - there are more details there, including the IP address of the user, as used to sign into Azure.

I don't think any of the responses return an IP address, so which JWT are you referring to?

@Alexander_Pastuhov

Another thing is that this authentication approach is still using the old method, without BFF. And BFF is the current best practice, so Microsoft (and others) would probably start breaking this old solution.

Do you have a source for this that we could look at? The sample project for JS access doesn't mention anything about it.

[Alexander_Pastuhov]

I think you are using access_token to query user properties from graph, which is where this subset is coming from. But id_token itself may contain tons of additions details - it's configurable in Azure.

Here are two good videos about BFF:

alert‘OAuth 2 0’; // The impact of XSS on OAuth 2 0 in SPAs

alert‘OAuth 2 0’; // The impact of XSS on OAuth 2 0 in SPAs

Using the BFF pattern to secure SPA and Blazor Applications - Dominick Baier - NDC Oslo 2021

- YouTube

The idea is basically that the user/browser send the "code" to the server and the server gets "id_token" and whatever else itself, so it never crosses the browser. This deviates from the common approach and would cause issues for some SPA's, but with something like XData in the background doing this, the client web application can still make use of these tokens indirectly through it, essentially delegating such requests to the server.