msal

What is msal?

The msal (Microsoft Authentication Library) npm package is used to authenticate users and acquire tokens to access protected resources such as Microsoft Graph, other Microsoft APIs, or your own APIs. It supports various authentication flows and can be used in different environments including single-page applications (SPA), server-side applications, and mobile apps.

What are msal's main functionalities?

User Authentication

This code demonstrates how to configure the msal package for user authentication in a Node.js application. It sets up the client application with the necessary credentials and generates an authorization code URL.

const msal = require('@azure/msal-node');

const config = {
  auth: {
    clientId: 'your_client_id',
    authority: 'https://login.microsoftonline.com/your_tenant_id',
    clientSecret: 'your_client_secret'
  }
};

const cca = new msal.ConfidentialClientApplication(config);

const authCodeUrlParameters = {
  scopes: ['user.read'],
  redirectUri: 'http://localhost:3000/redirect'
};

cca.getAuthCodeUrl(authCodeUrlParameters).then((response) => {
  console.log(response);
}).catch((error) => console.log(JSON.stringify(error)));

Token Acquisition

This code demonstrates how to acquire an access token using an authorization code. The access token can then be used to access protected resources.

const tokenRequest = {
  code: 'auth_code_received_from_auth_code_url',
  scopes: ['user.read'],
  redirectUri: 'http://localhost:3000/redirect'
};

cca.acquireTokenByCode(tokenRequest).then((response) => {
  console.log('Access token:', response.accessToken);
}).catch((error) => console.log(JSON.stringify(error)));

Silent Token Acquisition

This code demonstrates how to silently acquire an access token for a user who is already signed in, without requiring user interaction.

const silentRequest = {
  account: account,
  scopes: ['user.read']
};

cca.acquireTokenSilent(silentRequest).then((response) => {
  console.log('Access token:', response.accessToken);
}).catch((error) => console.log(JSON.stringify(error)));

Other packages similar to msal

passport-azure-ad

The passport-azure-ad package is a collection of Passport strategies to help you integrate with Azure Active Directory. It supports various authentication flows including OpenID Connect, OAuth 2.0, and SAML. Compared to msal, passport-azure-ad is more focused on integrating with the Passport.js middleware for Node.js applications.

oidc-client

The oidc-client package is a JavaScript library for OpenID Connect (OIDC) and OAuth2. It is used for managing user authentication and token management in client-side applications. While msal is specifically designed for Microsoft identity platform, oidc-client is more generic and can be used with any OIDC-compliant identity provider.

auth0-js

The auth0-js package is a client-side library for integrating with Auth0, a popular identity-as-a-service provider. It provides similar functionalities to msal, such as user authentication and token acquisition, but is designed to work with Auth0's identity platform rather than Microsoft's.

README

Microsoft Authentication Library Preview for JavaScript (MSAL.js)

Getting Started	Docs	Library Reference	Support	Samples

The MSAL library preview for JavaScript is the core library which enables JavaScript web applications to authenticate enterprise users using Microsoft Azure Active Directory (AAD), Microsoft account users (MSA), users using social identity providers like Facebook, Google, LinkedIn etc. and get access to Microsoft Cloud OR Microsoft Graph.

Important Note about the MSAL Preview

This library is suitable for use in a production environment. We provide the same production level support for this library as we do our current production libraries. During the preview we may make changes to the API, internal cache format, and other mechanisms of this library, which you will be required to take along with bug fixes or feature improvements. This may impact your application. For instance, a change to the cache format may impact your users, such as requiring them to sign in again. An API change may require you to update your code. When we provide the General Availability release we will require you to update to the General Availability version within six months, as applications written using a preview version of library may no longer work.

Usage

You can learn in detail about MSAL.js installation and usage documented in the MSAL Wiki.

Community Help and Support

• FAQs for access to our frequently asked questions

• Stack Overflow using "msal" and "msal.js" tag. We highly recommend you ask your questions on Stack Overflow first and browse existing issues to see if someone has asked your question before.

• GitHub Issues for reporting a bug or feature requests

• User Voice page to provide recommendations and/or feedback

Contribute

We enthusiastically welcome contributions and feedback. Please read the contributing guide before you begin.

Security Library

This library controls how users sign-in and access services. We recommend you always take the latest version of our library in your app when possible. We use semantic versioning so you can control the risk associated with updating your app. As an example, always downloading the latest minor version number (e.g. x.y.x) ensures you get the latest security and feature enhanements but our API surface remains the same. You can always see the latest version and release notes under the Releases tab of GitHub.

Security Reporting

If you find a security issue with our libraries or services please report it to [e-mail] with as much detail as possible. Your submission may be eligible for a bounty through the Microsoft Bounty program. Please do not post security issues to GitHub Issues or any other public site. We will contact you shortly upon receiving the information. We encourage you to get notifications of when security incidents occur by visiting this page and subscribing to Security Advisory Alerts.

License

Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT License (the "License");

We Value and Adhere to the Microsoft Open Source Code of Conduct

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [e-mail] with any additional questions or comments.