Writing Bearer Token to Javascript - oauth-2.0

Question

I'm trying to do a Proof of Concept. I'm using Azure Active Directory and trying to implement OAuth in a legacy project.
Half of this project is using Web Forms, the other half is calling WebAPI in another project directly through javascript.
As a test, I obtain the Bearer Token though the AuthorizationCodeReceived notification event of the UseOpenIdConnectAuthentication. I quickly write the token to a page that is calling the WebAPI with the following code:
$.ajax({
url: baseVotingHeaderURL,
type: 'GET',
dataType: "json",
beforeSend: function(xhr){
xhr.setRequestHeader('Authorization', 'Bearer ' + XXXXXXXXXXXXXXXXX);
},
success: function(result) {
options.success(result);
},
error: function(err) {
options.error(err);
}
});
I can see in Fiddler that the token is being passed:
No Proxy-Authorization Header is present.
Authorization Header is present: Bearer XXXXXXXXXXXXXXXX (I've obviously substituted the token with X's)
I'm still getting an Unauthorized 401.
Why doesn't this work?
Below is the code from Startup.Auth.cs
app.SetDefaultSignInAsAuthenticationType( CookieAuthenticationDefaults.AuthenticationType );
app.UseCookieAuthentication( new CookieAuthenticationOptions( ) );
app.UseWindowsAzureActiveDirectoryBearerAuthentication( new WindowsAzureActiveDirectoryBearerAuthenticationOptions
{
Tenant = "XXXXXX.onmicrosoft.com",
AuthenticationType = "OAuth2Bearer",
TokenValidationParameters = new TokenValidationParameters( )
{
ValidAudience = "https://XXXX.onmicrosoft.com/XXXXX"
}
} );
app.UseOpenIdConnectAuthentication(
new OpenIdConnectAuthenticationOptions
{
ClientId = "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
Authority = "https://login.microsoftonline.com/XXXXX.onmicrosoft.com",
PostLogoutRedirectUri = "https://XXXXXXX/gbl/Home.aspx",
Notifications = new OpenIdConnectAuthenticationNotifications
{
AuthenticationFailed = context =>
{
context.HandleResponse( );
context.Response.Redirect( "/Error?message=" + context.Exception.Message );
return Task.FromResult( 0 );
},
AuthorizationCodeReceived = context =>
{
var client = ClientId;
var key = "XXXXXXXXXXXXXXXXXXX=";
var credential = new ClientCredential( client, key );
var authority = String.Format( CultureInfo.InvariantCulture, #"https://login.microsoftonline.com/{0}", "XXXXX.onmicrosoft.com" );
var authContext = new Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext( authority );
Uri redirectUri = new Uri( HttpContext.Current.Request.Url.GetLeftPart( UriPartial.Path ) );
var apiResourceId = "https://graph.windows.net";
AuthenticationResult result = authContext.AcquireTokenByAuthorizationCode(
context.Code, redirectUri, credential, apiResourceId );
EndpointAndTokenHelper.DecodeAndWrite( result.AccessToken );
System.Diagnostics.Debug.WriteLine( result.AccessToken );
return Task.FromResult( 0 );
}
}
} );
}

Answer 1

I was following the examples verbatim. However, the final parameter in the authContext.AquireTokenByAuthorizationCode should have been my WebAPI resource and not https://graph.windows.net.
I don't know why the examples use https://graph.windows.net.