title: How to get Azure easy auth JWT access_token
body: <p>I have an Azure App Service on which I have enabled Authentication/Authorization and configured AD as the authentication provider.</p>
  
  <p>All <code>/.auth</code> routes exist on the service, and I can log in. After successful login I can call <code>/.auth/me</code> to get the <code>access_token</code>. The response looks like:</p>
  
  <pre><code>[
    {
       "access_token": "AQABAAAAAA...Gni4EiQgAA",
       "expires_on": "2017-02-28T19:17:08.0000000Z",
       "id_token": JWT TOKEN
       ...
    }
  ]
  </code></pre>
  
  <p>I then use the <code>access_token</code> in an authorization bearer header to request data from the service.</p>
  
  <pre><code>"Authorization": "Bearer " + "AQABAAAAAA...Gni4EiQgAA"
  </code></pre>
  
  <p>My service returns the following error</p>
  
  <pre><code>IDX10708: 'System.IdentityModel.Tokens.JwtSecurityTokenHandler' cannot read this string: 'AQABAAAAAA...Gni4EiQgAA'.
  
  The string needs to be in compact JSON format, which is of the form: '&lt;Base64UrlEncodedHeader&gt;.&lt;Base64UrlEndcodedPayload&gt;.&lt;OPTIONAL, Base64UrlEncodedSignature&gt;'.
  </code></pre>
  
  <p>According to <a href="https://stackoverflow.com/questions/38419058/how-to-refresh-an-id-token-from-azure-ad-in-a-web-app">this discussion</a> the <code>access_token</code> is intended to be used as a Bearer token. I have also read <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-token-and-claims#access-tokens" rel="noreferrer">here</a> that the <code>access_token</code> is supposed to be base64 encoded but this does not appear to be the case.</p>
  
  <p>Additionally, if I use the <code>id_token</code> as a Bearer token, then authentication works as expected (the <code>id_token</code> is in JWT format).</p>
  
  <p><strong>Edit</strong></p>
  
  <p>When I manually implement the Oauth flow as described <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-code#use-the-authorization-code-to-request-an-access-token" rel="noreferrer">here</a>, I receive a proper JWT <code>access_token</code>.</p>
  
  <pre><code>GET
  https://login.microsoftonline.com/common/oauth2/authorize?client_id=client_id&amp;response_type=code&amp;redirect_uri=redirect_uri
  </code></pre>
  
  <p>Followed by</p>
  
  <pre><code>POST
  https://login.microsoftonline.com/common/oauth2/token
    grant_type=authorization_code
    client_id=client_id
    code=CODE FROM ABOVE
    redirect_uri=redirect_uri
    resource=resource
    client_secret=client_secret
  
  RESPONSE
  {
    "access_token": JWT TOKEN,
    "token_type": "Bearer",
    ...
  }
  </code></pre>