@azure/msal-node

What is @azure/msal-node?

The @azure/msal-node package is a Microsoft library that enables Node.js applications to authenticate users and access secured resources in the Microsoft identity platform, such as Microsoft 365, Azure, and other resources that rely on Microsoft accounts. It supports various OAuth 2.0 and OpenID Connect flows.

What are @azure/msal-node's main functionalities?

Authentication

This code sample demonstrates how to configure the MSAL client and get an authorization code URL, which is the first step in the OAuth 2.0 authorization code flow.

const msal = require('@azure/msal-node');

const config = {
  auth: {
    clientId: 'your_client_id',
    authority: 'https://login.microsoftonline.com/common',
    clientSecret: 'your_client_secret',
  }
};

const cca = new msal.ConfidentialClientApplication(config);

const authCodeUrlParameters = {
  scopes: ['user.read'],
  redirectUri: 'http://localhost:3000/redirect',
};

cca.getAuthCodeUrl(authCodeUrlParameters).then((response) => {
  console.log(response);
});

Acquiring Tokens

This code sample shows how to exchange an authorization code for an access token, which can be used to access secured resources.

const tokenRequest = {
  code: 'authorization_code_received_from_auth_code_url',
  scopes: ['user.read'],
  redirectUri: 'http://localhost:3000/redirect',
};

cca.acquireTokenByCode(tokenRequest).then((response) => {
  console.log(response);
}).catch((error) => {
  console.error(error);
});

Silent Token Acquisition

This code sample illustrates how to silently acquire an access token using a cached account, which is useful for renewing tokens without user interaction.

const silentTokenRequest = {
  account: cca.getAccountByHomeId('user_home_id'),
  scopes: ['user.read'],
};

cca.acquireTokenSilent(silentTokenRequest).then((response) => {
  console.log(response);
}).catch((error) => {
  if (error instanceof msal.InteractionRequiredAuthError) {
    // Fallback to interactive method if silent acquisition fails
  }
});

Other packages similar to @azure/msal-node

passport-azure-ad

Passport-azure-ad is a collection of Passport Strategies to help you integrate with Azure Active Directory. It is similar to @azure/msal-node but uses the Passport.js framework, which is popular for handling authentication in Node.js applications.

oidc-client

The oidc-client package provides a client-side library for web applications that need to perform OpenID Connect (OIDC) and OAuth 2.0 protocols. Unlike @azure/msal-node, which is designed for server-side Node.js applications, oidc-client is intended for use in browser-based applications.

simple-oauth2

Simple-oauth2 is a Node.js library for interacting with OAuth 2.0 and simplifying the process of adding token-based authentication to applications. It provides a simpler and more lightweight alternative to @azure/msal-node, but it does not have specific integrations with Microsoft identity platform.

README

Microsoft Authentication Library for Node (msal-node)

Getting Started	AAD Docs	Library Reference

1. About
2. FAQ
3. Changelog
4. Prerequisites
5. Installation
6. Node Version Support
7. Usage
8. Samples
9. Build Library
10. Security Reporting
11. License
12. Code of Conduct

About

MSAL Node enables applications to authenticate users using Azure AD work and school accounts (AAD), Microsoft personal accounts (MSA) and social identity providers like Facebook, Google, LinkedIn, Microsoft accounts, etc. through Azure AD B2C service. It also enables your app to get tokens to access Microsoft Cloud services such as Microsoft Graph.

OAuth2.0 grant types supported:

The current version supports the following ways of acquiring tokens:

Public Client:

• Authorization Code Grant with PKCE
• Device Code Grant
• Refresh Token Grant
• Silent Flow
• Username and Password flow

Confidential Client:

• Authorization Code Grant with a client credential
• Refresh Token Grant
• Silent Flow
• Client Credential Grant
• On-behalf-of flow
• Username and Password flow

More details on different grant types supported by Microsoft authentication libraries in general can be found here.

Scenarios supported:

The scenarios supported with this library are:

• Desktop app that calls web APIs
• Web app that calls web APIs
• Web APIs that call web APIs
• Daemon apps

More details on scenarios and the authentication flows that map to each of them can be found here.

FAQ

See here.

Prerequisites

Before using @azure/msal-node you will need to register your app in the azure portal:

• App registration

Installation

Via NPM:

npm install @azure/msal-node

Node Version Support

MSAL Node will follow the Long Term Support (LTS) schedule of the Node.js project. Our support plan is as follows.

Any major MSAL Node release:

• Will support stable (even-numbered) Maintenance LTS, Active LTS, and Current versions of Node
• Will drop support for any previously supported Node versions that have reached end of life
• Will not support prerelease/preview/pending versions until they are stable

MSAL Node version	MSAL support status	Supported Node versions
2.x.x	Active development	16, 18, 20
1.x.x	In maintenance	10, 12, 14, 16, 18

Note: There have been no functional changes in the MSAL Node v2 release.

Usage

MSAL basics

• Understand difference in between Public Client and Confidential Clients
• Initialize a Public Client Application
• Initialize a Confidential Client Application
• Configuration
• Request
• Response

Samples

There are multiple samples included in the repository that use MSAL Node to acquire tokens. These samples are currently used for manual testing, and are not meant to be a reference of best practices, therefore use judgement and do not blindly copy this code to any production applications.

AAD samples:

• auth-code: Express app using OAuth2.0 authorization code flow.
• auth-code-pkce: Express app using OAuth2.0 authorization code flow with PKCE.
• device-code: Command line app using OAuth 2.0 device code flow.
• refresh-token: Command line app using OAuth 2.0 refresh flow.
• silent-flow: Express app using OAuth2.0 authorization code flow to acquire a token and store in the token cache, and silent flow to use tokens in the token cache.
• client-credentials: Daemon app using OAuth 2.0 client credential grant to acquire a token.
• on-behalf-of: Web application using OAuth 2.0 auth code flow to acquire a token for a web API. The web API validates the token, and calls Microsoft Graph on behalf of the user who authenticated in the web application.
• username-password: Web application using OAuth 2.0 resource owner password credentials (ROPC) flow to acquire a token for a web API.
• ElectronTestApp: Electron desktop application using OAuth 2.0 auth code with PKCE flow to acquire a token for a web API such as Microsoft Graph.
• Hybrid Spa Sample: Sample demonstrating how to use enableSpaAuthorizationCode to perform SSO for applications that leverage server-side and client-side authentication using MSAL Browser and MSAL Node.

B2C samples:

• b2c-user-flows: Express app using OAuth2.0 authorization code flow.

Others:

• msal-node-extensions: Uses authorization code flow to acquire tokens and the msal-extensions library to write the MSAL in-memory token cache to disk.

Build and Test

// Install dependencies from root of repo
npm install

// Change to the msal-node package directory
cd lib/msal-node

// To run build for common package & node package
npm run build:all

// To run build only for node package
npm run build

// To run tests
npm run test

Local Development

Below is a list of commands you will probably find useful:

npm run build:modules:watch

Runs the project in development/watch mode. Your project will be rebuilt upon changes. TSDX has a special logger for you convenience. Error messages are pretty printed and formatted for compatibility VS Code's Problems tab. The library will be rebuilt if you make edits.

npm run build

Bundles the package to the dist folder. The package is optimized and bundled with Rollup into multiple formats (CommonJS, UMD, and ES Module).

npm run build:all

Builds both msal-common and msal-node

npm run lint

Runs eslint with Prettier

npm test, npm run test:coverage, npm run test:watch

Runs the test watcher (Jest) in an interactive mode. By default, runs tests related to files changed since the last commit. Generate code coverage by adding the flag --coverage. No additional setup needed. Jest can collect code coverage information from entire projects, including untested files.

Security Reporting

If you find a security issue with our libraries or services please report it to [e-mail] with as much detail as possible. Your submission may be eligible for a bounty through the Microsoft Bounty program. Please do not post security issues to GitHub Issues or any other public site. We will contact you shortly upon receiving the information. We encourage you to get notifications of when security incidents occur by visiting this page and subscribing to Security Advisory Alerts.

License

Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT License.

We Value and Adhere to the Microsoft Open Source Code of Conduct

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [e-mail] with any additional questions or comments.