How to get the Azure AD access token from Sitecore Identity Server after using the Azure AD login and use the token for call to external APIs?

Question

I have a Sitecore 9.2 application and a feature project for Web API . In the API controller classes I need to get the access token issued from Azure AD after using the Azure AD login on my Sitecore Identity Server.

I am unable to access the token at present as I don't know how to access it. My current .NET Framework version is 4.7.2 .

Answer 1

You can access IdToken in SecurityTokenValidated or OnRedirectToIdentityProvider event within your ConfigureServices OWIN pipeline.

You may need to persist this IdToken in say Redis to access it elsewhere in your business logic.

We have examples of how this has been done, such as in this post and this one

Sample ConfigureServices snippet, original code on my repo. You can see the context.ProtocolMessage.IdToken is available for you.

public void ConfigureServices(IServiceCollection services)
{
    Ids4DemoIdentityProvider identityProvider = this._appSettings.Ids4DemoIdentityProvider;
    if (!identityProvider.Enabled)
        return;
    this._logger.LogDebug("Configure '" + identityProvider.DisplayName + "'. AuthenticationScheme = " + identityProvider.AuthenticationScheme + ", ClientId = " + identityProvider.ClientId, Array.Empty<object>());
    new AuthenticationBuilder(services).AddOpenIdConnect(identityProvider.AuthenticationScheme, identityProvider.DisplayName, (Action<OpenIdConnectOptions>)(options =>
    {
        options.SignInScheme    = "idsrv.external";
        options.ClientId        = identityProvider.ClientId;
        options.Authority       = identityProvider.Authority;
        options.MetadataAddress = identityProvider.MetadataAddress;
        options.CallbackPath    = "/signin-idsrv";
        options.Events.OnRedirectToIdentityProvider += (Func<RedirectContext, Task>)(context =>
        {
            Claim first = context.HttpContext.User.FindFirst("idp");
            if (string.Equals(first != null ? first.Value : (string)null, identityProvider.AuthenticationScheme, StringComparison.Ordinal))
                context.ProtocolMessage.Prompt = "select_account";
            return Task.CompletedTask;
        });
    }));
}