Error: 401 Unauthorized with AzureAD Authorization on Backend

[microsoft]

Error: 401 Unauthorized with AzureAD Authorization on Backend

[alliscode]

Hi @tdebiasio, thank you for creating this issue. We are in the process of moving Copilot Chat to its own repo located here:
https://github.com/microsoft/chat-copilot

I'm transferring this issue to that repo where we will take a look :).

[glahaye]

Hi @tdebiasio

AAD can be a pain to setup. Let's start by verifying the info in your .env file.

Does it look something like this:

REACT_APP_BACKEND_URI=https://localhost:40443/
REACT_APP_AAD_AUTHORITY=https://login.microsoftonline.com/YOUR_TENANT_ID
REACT_APP_AAD_CLIENT_ID=YOUR_CLIENT_ID

Where YOUR_TENANT_ID is your AAD tenant's GUID and YOUR_CLIENT_ID is your frontend client ID's GUID?

[tdebiasio]

@glahaye, that's correct and for the appsettings.json I have the following using the same tenant and client IDs as in the .env file:

  "Authorization": {
    "Type": "AzureAd",
    "ApiKey": "",
    "AzureAd": {
      "Instance": "https://login.microsoftonline.com/",
      "TenantId": "TENANT_ID",
      "ClientId": "CLIENT_ID",
      "Scopes": "access_as_user"
    }
  },

[glahaye]

I think that's your problem right there!

You need TWO distinct app registrations: one for your frontend and one for your backend.

I was trying to find where in the documentation we mention that but it seems it's never been in there!

I've created #54 to address this.

I should get around to work on the documentation this week. In the meantime, create a second app registration for the backend. It doesn't need any redirect URL's.

Here's some more info before I get around to writing the documentation:
https://damienbod.com/2020/06/08/angular-spa-with-an-asp-net-core-api-using-azure-ad-auth-and-user-access-tokens/
https://stackoverflow.com/questions/73047805/setup-spa-frontend-and-backend-as-separate-azure-ad-app-registrations

[glahaye]

@tdebiasio Have a look at the following PR. It gives you all the steps you need to make Azure AD Auth work:
#66

If this fixes your problem, please close this issue!

[glahaye]

The PR is now merged. All steps required to properly set up AAD are detailed.

[glahaye]

Furthermore, the client now has all the elements needed to support AAD correctly.

Solution verified to work.

Closing this issue.

Don't hesitate to reply if more information is required.