Default implicit flow in Microsoft Identify web

[kunj-sangani]

Why is auth code not default grant types when we use Microsoft Identify web currently we have implicit flow grant type which has its own drawbacks and hence Auth code flow would be a better option

[waldekmastykarz]

Where do you see auth code not being the default @kunj-sangani?

[kunj-sangani]

Hi @waldekmastykarz

Thank you for taking this question

Grant type implicity is default when we add below lines of code after adding Microsoft.Identity.Web nuget package

builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
.AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"))

This indicates that if we want to use grant type Auth code with PKCE grant type
https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow

then we need to configure it in a different way which is actually not properly documented and I think it should be the default one when used using the above code and if some one wants to use implicity grant type then they should change the configuration

services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
.AddAzureAD(options => Configuration.Bind("AzureAd", options))
.AddJwtBearer(options => Configuration.Bind("AzureAd", options))
.AddOpenIdConnect("AzureAd", "Azure AD", options =>
{
Configuration.Bind("AzureAd", options);

    options.ResponseType = "code";
    options.UsePkce = true;
    options.TokenValidationParameters.NameClaimType = "name";
});

[waldekmastykarz]

Understood. I'll pass it on to the team that owns the package. Thank you for bringing it up.