Missing nonce parameter when requesting id_tokens

[moudis]

The documentation indicates that a user might wish to set the response type in calls to get_authorization_request_url to id_token. However, doing that results in an error from Azure AD: "AADSTS90014: The required field nonce is missing.". Manually appending the nonce as a query string parameter (&nonce=value) to the generated URL works fine.

Would it make sense to add a nonce argument to that function to support that request type?

An example of a failing call is:

url = msal_app.get_authorization_request_url([],
                                             redirect_uri='http://localhost:5000/signin-oidc',
                                             state=state,
                                             response_type='id_token')

... where msal_app is a ConfidentialClientApplication, and state is just a v4 UUID.

[rayluo]

Thanks James for bringing this to our attention.

Support for nonce takes more than just accepting a nonce parameter in get_authorization_request_url() though, because you would then also want/need to somehow validate it. We will need to give it more thoughts.

Meanwhile, nonce is optional if you use Authorization Code grant (i.e. response_type="code"). We have a workable sample demonstrating how to do Authorization Code grant in a web app, AND you can still have an ID token comes back, without needing to deal with nonce.

[rayluo]

In PR #173, we added nonce parameter not just in get_authorization_request_url(..., nonce=...), but also in acquire_token_by_authorization_code(..., nonce=...). We will close this issue, once we release the next version.

[fazil1987]

can anyone explain what's the point of nonce parameter ? Ray Luo (@rayluo) ?

[rayluo]

fazil1987 Per OIDC specs, nonce is used to prevent replay attack. The specs itself does not provide further information, but you may be able to find some more information out there, such as this one.

Should you have further generic question on this topic, I would encourage you to ask question in those generic websites such as Stackoverflow.com, or at least create a separated github issue. This particular github issue here was about adding that parameter, and it has been implemented therefore such topic is closed here.

[rayluo]

For posterity, after the we answered this question in March 2020, MSAL Python has been improved. Since Dec 7, 2020, MSAL Python 1.7.0+ has built-in PKCE support, which automatically uses nonce under the hood, so MSAL Python's caller does not need to worry about nonce at all. The corresponding web app sample is also simplified.