Random 401 error with same valid token

[hamzawii]

Hello,
After a week of testing and debug, I am completely stuck with random 401 errors on azure/msal-angular (v2.0.5) and passport-azure-ad (v4.3.1) authentification (with Nest.js).

Here is my app.module.ts :

...
export function MSALInterceptorConfigFactory(): MsalInterceptorConfiguration {
  const protectedResourceMap = new Map<string, Array<string>>();
  protectedResourceMap.set('https://graph.microsoft.com/v1.0/me', [`api://${environment.AAD_CLIENT_ID}/access_as_user`]);
  protectedResourceMap.set('/api/authentification/checkOpenId', [`api://${environment.AAD_CLIENT_ID}/access_as_user`]);

  return {
    interactionType: InteractionType.Redirect,
    protectedResourceMap
  };
}

export function MSALGuardConfigFactory(): MsalGuardConfiguration {
  return {
    interactionType: InteractionType.Redirect,
    authRequest: {
      scopes: ['user.read', 'openid']
    },
    loginFailedRoute: environment.AAD_REDIRECT_URI + 'home'
  };
}
...

When i try to access to a protected route (canActivate: [MsalGuard]) i am redirected to MS login page, and then redirected again to my app.

After that, i call the /checkOpenId route, MSAR is adding the Bearer Token, but here is the problem: i got a random responses from /checkOpenId, some times it is 200 ok and some times it is a 401 unauthorized.

I compared a 401 and a 200 queries and they are the same (token, header) :

Here is my azure ad strategy :

@Injectable()
export class AzureADStrategy extends PassportStrategy(
    BearerStrategy,
    'aad',
) {
    constructor(private _mdmService: MDMService) {
        super({
            identityMetadata: `https://login.microsoftonline.com/${tenantID}/v2.0/.well-known/openid-configuration`,
            clientID: clientID,
            audience: `api://${clientID}`,
            validateIssuer: false,
            loggingNoPII: false,
            proxy: `${proxyHost}:${proxyPort}`,
        });
    }

    async validate(data) {
        //my validate is not called when there is a 401
    }
}

[jasonnutter]

Hard to determine without more information. Have you tried debugging passport-azure-ad to see why it returns a 401?