{"action":"created","issue":{"url":"https://api.github.com/repos/AzureAD/passport-azure-ad/issues/187","repository_url":"https://api.github.com/repos/AzureAD/passport-azure-ad","labels_url":"https://api.github.com/repos/AzureAD/passport-azure-ad/issues/187/labels{/name}","comments_url":"https://api.github.com/repos/AzureAD/passport-azure-ad/issues/187/comments","events_url":"https://api.github.com/repos/AzureAD/passport-azure-ad/issues/187/events","html_url":"https://github.com/AzureAD/passport-azure-ad/issues/187","id":174593450,"number":187,"title":"p parameter is not being passed in each flow through the passport.js library","user":{"login":"brandwe","id":1471883,"avatar_url":"https://avatars.githubusercontent.com/u/1471883?v=3","gravatar_id":"","url":"https://api.github.com/users/brandwe","html_url":"https://github.com/brandwe","followers_url":"https://api.github.com/users/brandwe/followers","following_url":"https://api.github.com/users/brandwe/following{/other_user}","gists_url":"https://api.github.com/users/brandwe/gists{/gist_id}","starred_url":"https://api.github.com/users/brandwe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brandwe/subscriptions","organizations_url":"https://api.github.com/users/brandwe/orgs","repos_url":"https://api.github.com/users/brandwe/repos","events_url":"https://api.github.com/users/brandwe/events{/privacy}","received_events_url":"https://api.github.com/users/brandwe/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/AzureAD/passport-azure-ad/labels/P1","name":"P1","color":"207de5"}],"state":"open","locked":false,"assignee":{"login":"lovemaths","id":6593843,"avatar_url":"https://avatars.githubusercontent.com/u/6593843?v=3","gravatar_id":"","url":"https://api.github.com/users/lovemaths","html_url":"https://github.com/lovemaths","followers_url":"https://api.github.com/users/lovemaths/followers","following_url":"https://api.github.com/users/lovemaths/following{/other_user}","gists_url":"https://api.github.com/users/lovemaths/gists{/gist_id}","starred_url":"https://api.github.com/users/lovemaths/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lovemaths/subscriptions","organizations_url":"https://api.github.com/users/lovemaths/orgs","repos_url":"https://api.github.com/users/lovemaths/repos","events_url":"https://api.github.com/users/lovemaths/events{/privacy}","received_events_url":"https://api.github.com/users/lovemaths/received_events","type":"User","site_admin":false},"assignees":[{"login":"lovemaths","id":6593843,"avatar_url":"https://avatars.githubusercontent.com/u/6593843?v=3","gravatar_id":"","url":"https://api.github.com/users/lovemaths","html_url":"https://github.com/lovemaths","followers_url":"https://api.github.com/users/lovemaths/followers","following_url":"https://api.github.com/users/lovemaths/following{/other_user}","gists_url":"https://api.github.com/users/lovemaths/gists{/gist_id}","starred_url":"https://api.github.com/users/lovemaths/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lovemaths/subscriptions","organizations_url":"https://api.github.com/users/lovemaths/orgs","repos_url":"https://api.github.com/users/lovemaths/repos","events_url":"https://api.github.com/users/lovemaths/events{/privacy}","received_events_url":"https://api.github.com/users/lovemaths/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/AzureAD/passport-azure-ad/milestones/2","html_url":"https://github.com/AzureAD/passport-azure-ad/milestones/3.0.0","labels_url":"https://api.github.com/repos/AzureAD/passport-azure-ad/milestones/2/labels","id":1935195,"number":2,"title":"3.0.0","description":"","creator":{"login":"polita","id":7873171,"avatar_url":"https://avatars.githubusercontent.com/u/7873171?v=3","gravatar_id":"","url":"https://api.github.com/users/polita","html_url":"https://github.com/polita","followers_url":"https://api.github.com/users/polita/followers","following_url":"https://api.github.com/users/polita/following{/other_user}","gists_url":"https://api.github.com/users/polita/gists{/gist_id}","starred_url":"https://api.github.com/users/polita/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/polita/subscriptions","organizations_url":"https://api.github.com/users/polita/orgs","repos_url":"https://api.github.com/users/polita/repos","events_url":"https://api.github.com/users/polita/events{/privacy}","received_events_url":"https://api.github.com/users/polita/received_events","type":"User","site_admin":false},"open_issues":14,"closed_issues":1,"state":"open","created_at":"2016-08-10T17:17:16Z","updated_at":"2016-09-01T20:56:20Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2016-09-01T18:30:06Z","updated_at":"2016-09-02T07:18:43Z","closed_at":null,"body":"As hinted at by the developer in this code comment: https://github.com/AzureAD/passport-azure-ad/blob/master/lib/oidcstrategy.js#L1135, we have to pass the p parameter in each flow so that the right code (https://github.com/AzureAD/passport-azure-ad/blob/master/lib/oidcstrategy.js#L375) gets invoked at every auth flow. Right now it is not being passed after the first call to the library and so the metadata endpoint reverts to the old (non-policy) metadata URL\r\n\r\nYou can see this by using a B2C tenant and turning on logging level to info:\r\n\r\n```bash\r\n[2016-09-01T16:43:01.717Z]  INFO: AzureAD: OIDC Passport Strategy/8046 on brandons-mbp.guest.corp.microsoft.com: B2C: Found a policy inside of the login request. This is a B2C tenant!\r\n[2016-09-01T16:43:01.718Z]  INFO: AzureAD: OIDC Passport Strategy/8046 on brandons-mbp.guest.corp.microsoft.com: B2C: New Metadata url provided to Strategy was:  https://login.microsoftonline.com/isasample.site/v2.0/.well-known/openid-configuration?p=B2C_1_node_signin&x-client-SKU=passport-azure-ad&x-client-Ver=2.0.1\r\n[2016-09-01T16:43:01.718Z]  INFO: AzureAD: OIDC Passport Strategy/8046 on brandons-mbp.guest.corp.microsoft.com: Parsing Metadata:  https://login.microsoftonline.com/isasample.site/v2.0/.well-known/openid-configuration?p=B2C_1_node_signin&x-client-SKU=passport-azure-ad&x-client-Ver=2.0.1\r\n```\r\n\r\nBut then later in the same session:\r\n\r\n```bash\r\n::1 - - [01/Sep/2016:16:43:02 +0000] \"GET /login/?p=B2C_1_node_signin HTTP/1.1\" 302 0 \"http://localhost:3000/\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Safari/602.1.50\"\r\n[2016-09-01T16:43:06.718Z]  INFO: AzureAD: OIDC Passport Strategy/8046 on brandons-mbp.guest.corp.microsoft.com: Parsing Metadata:  https://login.microsoftonline.com/isasample.site/v2.0/.well-known/openid-configuration?x-client-SKU=passport-azure-ad&x-client-Ver=2.0.1```"},"comment":{"url":"https://api.github.com/repos/AzureAD/passport-azure-ad/issues/comments/244301649","html_url":"https://github.com/AzureAD/passport-azure-ad/issues/187#issuecomment-244301649","issue_url":"https://api.github.com/repos/AzureAD/passport-azure-ad/issues/187","id":244301649,"user":{"login":"lovemaths","id":6593843,"avatar_url":"https://avatars.githubusercontent.com/u/6593843?v=3","gravatar_id":"","url":"https://api.github.com/users/lovemaths","html_url":"https://github.com/lovemaths","followers_url":"https://api.github.com/users/lovemaths/followers","following_url":"https://api.github.com/users/lovemaths/following{/other_user}","gists_url":"https://api.github.com/users/lovemaths/gists{/gist_id}","starred_url":"https://api.github.com/users/lovemaths/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lovemaths/subscriptions","organizations_url":"https://api.github.com/users/lovemaths/orgs","repos_url":"https://api.github.com/users/lovemaths/repos","events_url":"https://api.github.com/users/lovemaths/events{/privacy}","received_events_url":"https://api.github.com/users/lovemaths/received_events","type":"User","site_admin":false},"created_at":"2016-09-02T07:18:43Z","updated_at":"2016-09-02T07:18:43Z","body":"This is not the cause. I debugged the oidc b2c sample for the implicit flow, we indeed have the 'p' in the 302 response. The req.query itself has 'p' parameter so we don't add one (https://github.com/AzureAD/passport-azure-ad/blob/master/lib/oidcstrategy.js#L1151) .\r\n\r\n```\r\n  if (req.query.p) {\r\n      location = `${config.authorizationURL}&${querystring.stringify(params)}`;  //<=== authorizationURL already has 'p=xxx'\r\n  } else {\r\n      location = `${config.authorizationURL}?${querystring.stringify(params)}`;\r\n  }\r\n```\r\nMy experiments shows the kid in metadata with 'p' is the same regardless of the policy,  but it is different from the kid in metadata without 'p'. The real problem is that the incoming request with token from AAD (POST with id_token in the body) doesn't have the 'p' param (even if we provided 'p' in the previous authentication request, and the token is for some specific policy 'p'), so oidcstrategy fetches the metadata without 'p', therefore the kid in metadata and kid in id_token don't match."}}
{"actor":{"display_login":"lovemaths"}}