Firebase Auth - Use Microsoft OAuth AccessToken to access Firebase Rest API

Question

I'm currently trying to use a microsoft access token to access my firebase api (and find out the userid within firebase-auth / google identity platform. Calling https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp ends in a 400

What have I done: Get my accesstoken by calling: https://login.microsoftonline.com/[tenant]/oauth2/v2.0/token This works well and I get a access_token, refresh_token and id_token in response.

After that I try to authenticate to GIP by using this documented REST Call: https://cloud.google.com/identity-platform/docs/use-rest-api#section-sign-in-with-oauth-credential

Unfortunately there are only examples available for google and twitter. Calling it with this body fails:

{
"postBody": "idToken=[AuthTokenFromMsCall]&providerId=microsoft.com",
    "requestUri":"http://localhost",
    "returnIdpCredential":true,
    "returnSecureToken":true,
    "tenant":"[ms_tenant]" //tried without this as well  
}

but get this response with code 400

{
  "error": {
    "code": 400,
    "message": "INVALID_CREDENTIAL_OR_PROVIDER_ID : Invalid IdP response/credential: http://localhost?idToken=[AccessToken]&providerId=microsoft.com",
    "errors": [
      {
        "message": "INVALID_CREDENTIAL_OR_PROVIDER_ID : Invalid IdP response/credential: http://localhost?[AccessToken]&providerId=microsoft.com",
        "domain": "global",
        "reason": "invalid"
      }
    ]
  }
}

Does anyone know how to configure my body parameters to get a 200 Response

Answer 1

As of this document seems, Firebase Auth doesn't currently support Microsoft authentication.

Unlike other OAuth providers supported by Firebase such as Google, Facebook, and Twitter, where sign-in can directly be achieved with OAuth access token based credentials, Firebase Auth does not support the same capability for providers such as Microsoft due to the inability of the Firebase Auth server to verify the audience of Microsoft OAuth access tokens.

There is a bug raised for this at github which is still open,Maybe you can add your concern there.