title: Using Bearer Authentication with Azure Active Directory Access Tokens
body: <p>I am using the <a href="https://github.com/AzureAD/passport-azure-ad" rel="nofollow noreferrer">Passport AAD project</a> with the bearer strategy to protect my endpoints. After I receive tokens with the OIDC strategy when logging in, I can't seem to get the bearer strategy to validate the signature of the access token. I get: </p>
  
  <pre><code>authentication failed due to: invalid signature
  </code></pre>
  
  <p>I have no problems validating the id_token, but I would prefer not to use this for our client app if the id_token can't be refreshed with AAD. Also, when using <a href="https://jwt.io/" rel="nofollow noreferrer">jwt.io</a> to test the validation with the <a href="https://login.microsoftonline.com/common/discovery/keys" rel="nofollow noreferrer">published public keys</a>, I see the same issue (can validate the id_token, but not the access_token).</p>
  
  <p>Am I missing a step when grabbing the access token, or is there a gap in my understanding of how access tokens are validated?</p>
  
  <p><strong>Update with more details</strong></p>
  
  <p>I am requesting an access token from my tenant:</p>
  
  <pre><code>identityMetadata: https://login.microsoftonline.com/your_tenant_name.onmicrosoft.com/.well-known/openid-configuration,
  responseType: 'id_token code'
  </code></pre>
  
  <p>Using the OIDCStrategy in the AAD Passport project.</p>
  
  <pre><code>const callbackOIDC = (iss, sub, profile, accessToken, refreshToken, params, done) =&gt; {
    return done(null,{
      profile,
      accessToken,
      refreshToken
    });
  };
  
  passport.use(new OIDCStrategy(config.creds, callbackOIDC));
  </code></pre>
  
  <p>Then I run authenticate, shown below:</p>
  
  <pre><code>auth.adCallback = function (req, res, next) {
    passport.authenticate('azuread-openidconnect', {
      response: res,
      resourceURL: 'https://graph.microsoft.com',
      session: false
    }, function (err, user, info) {
      console.log(user.access_token);
    })(req, res, next);
  };
  </code></pre>
  
  <p>I think I may have been asking for a graph access token above by specifying the resource URL. If I remove that resource URL, I still get an access token, but the bearer strategy throws an invalid token error (instead of an invalid signature error). Is there a different resource URL I should be setting to match with my tenant and get the access token I'm looking for?</p>