title: Cannot Authenticate SPA with passport-azure-ad's Bear Strategy
body: <p>So I was playing get <code>Integrating Azure AD into an AngularJS single page app
  </code> this tutorial to work. 
  <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-devquickstarts-angular-node" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-devquickstarts-angular-node</a></p>
  
  <p>It is implemented for the Azure AD v2.0 endpoint, but unfortunately my organization does not support the Azure AD v2.0 endpoint, therefore I replaced the experimental version of <code>adal.js</code> and <code>adal-angular</code> libraries with GA <code>adal.js</code> and <code>adal-angular</code>libraries. The front-end authentication works perfect. However after I modified the back-end config based on <code>passport-azure-ad</code>. The back-end failed to authenticate the tokens that was implicitly granted. </p>
  
  <p>I have set the <code>allow implicit flow</code> to true in the manifest file. Also I tried to use my <code>client ID</code> and <code>Tenant Name</code> in another example that uses the same <code>angular</code> front end but <code>.NET</code> as the back-end. It worked! </p>
  
  <p>Here is my back-end config</p>
  
  <pre><code>exports.creds = {
  
      // The app id you get from the registration portal
      audience: 'http://localhost:8080',
      clientID: '**********************************',
  
      // Passport will use this URL to fetch the token validation information from Azure AD
      identityMetadata: '************************************',
      // Required.
      // If you are using the common endpoint, you should either set `validateIssuer` to false, or provide a value for `issuer`.
      validateIssuer: true,
  
      // Required.
      // Set to true if you use `function(req, token, done)` as the verify callback.
      // Set to false if you use `function(req, token)` as the verify callback.
      passReqToCallback: false,
  
      // Required if you are using common endpoint and setting `validateIssuer` to true.
      // For tenant-specific endpoint, this field is optional, we will use the issuer from the metadata by default.
      issuer: '**************************************',
  
      isB2C: false,
  
      // Optional. Default value is false.
      // Set to true if you accept access_token whose `aud` claim contains multiple values.
      allowMultiAudiencesInToken: false,
  
      // Optional. 'error', 'warn' or 'info'
      loggingLevel: 'info'
  };
  </code></pre>
  
  <p>My server:</p>
  
  <pre><code>app.use(bodyParser.urlencoded({ extended: true }));
  app.use(bodyParser.json());
  
  // Pull in the Azure AD bearer passport strategy
  var OIDCBearerStrategy = require('passport-azure-ad').BearerStrategy;
  
  // This object is used for in-memory data storage, instead of a database.
  // Each time you run the server, you will get a fresh, empty list.
  var tasks = [];
  
  // Load passport and configure it to use Azure AD Bearer auth
  app.use(passport.initialize());
  passport.use(new OIDCBearerStrategy({
      identityMetadata: config.creds.identityMetadata,
      audience: config.creds.audience,
      clientID: config.creds.clientID,
      validateIssuer: true,
      issuer: config.creds.issuer,
  
  }, function (token, done) {
      console.log("yooo");
      return done(null, token, null);
  }));
  
  var router = express.Router();
  router.route('/api/tasks')
      .post(passport.authenticate('oauth-bearer', { session: false }), controller)
  </code></pre>
  
  <p>Here is the output from my browser console after the front-end authenticated:</p>
  
  <pre><code>State: **************
  adal.js:973 State status:true
  adal.js:973 State is right
  </code></pre>
  
  <p>Has anybody done similar things?</p>