Getting id_token from Microsoft OAuth2.0

Question

Cordova Plugin: https://github.com/nraboy/ng-cordova-oauth and ionic v1

I am using a modified version of oauthWindowslive. I am trying to get id_token form the Microsoft OAuth2.0. Since I am using the service to get some outlook calendar data I am using the following:

var browserRef = window.cordova.InAppBrowser.open('https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=' + clientId + "&scope=openid+profile+User.Read"  + '&response_type=token&response_mode=fragment' + '&display=touch' + '&redirect_uri=' + redirect_uri, '_blank', 'location=no,clearsessioncache=yes,clearcache=yes');

But if I insert id_token+token for the response_type I cannot authenticate. I cannot authenticate even if I try using id_token even if I try using it by itself.

Answer 1

I finally got it working. The web service is picky about two things:

1. id_token has to come before token and it should be immediately after the response_type prompt. response_type=id_token+token
2. While the documentation says it is ok to use the http://localhost/callback - in reality, it is not. At least, on a hybrid app it has to be https://login.live.com/oauth20_desktop.srf

Interestingly enough for other Oauth services such as Google and Facebook localhost/callback works fine. Microsoft for some reason requires special treatment. If anyone from Microsoft is listening - please clean up and merge your identity platforms and documentation. It should not take a developer 5 days to figure out something so trivial.