rubyazurejwtazure-active-directory

Microsoft Azure doesn't return email via Oauth2 flow


I am making Oauth2 flow with ruby and Microsoft Azure Active Directory. Basically authentication works fine, except fact that when I decode token I do not receive email of user. Here is what I receive from Azure after authentication:

{
"token_type"=>"Bearer",
"scope"=>"profile openid email https://graph.microsoft.com/User.Read",
"ext_expires_in"=>3599,
"id_token"=> id_token_here,
"access_token"=> access_token_here,
"refresh_token"=>nil,
"expires_at"=>1572529008
}

When I try to decode "id_token" via I receive this kind of object:

{
"aud"=>"fa792156-3c62...",
"iss"=>"https://login.microsoftonline.com/some_sensitive_data/v2.0",
"iat"=>1572525194,
"nbf"=>1572525194,
"exp"=>1572529094,
"sub"=>"1ML3cHqqyg_...",
"tid"=>"fa024876-4da...",
"uti"=>"wvSdJLUxI0W...",
"ver"=>"2.0"
}

So I do NOT have email or something like this. When I try to login with another account I do receive 'preferred_username' or 'email' keys. Any help is appreciated


Solution

  • I tried both single tenant and multi tenant, also tried tenant user and guest user. But I didn't reproduce your issue. Here are my steps.

    Use code auth flow to get the code:

    https://login.microsoftonline.com/xx.onmicrosoft.com/oauth2/v2.0/authorize?
    client_id=cbc32712-ac27-4532XXXd-303998a6e712
    &response_type=code
    &redirect_uri=http://localhost
    &response_mode=query
    &scope=profile openid email https://graph.microsoft.com/User.Read
    &state=12345
    

    Use the code to get id token

    enter image description here

    enter image description here

    Decode the id token

    enter image description here