Run the code flow by hand

Steps

1. Read your test tenant's discovery document and find each endpoint.

   What the server will check: Nothing to check. Note the authorization, token and UserInfo endpoints.

2. Register a client whose redirect URI is the lab callback page.

   What the server will check: The client exists in your tenant.

3. Build the authorization URL, open it and sign in as a test user.

   What the server will check: Your tenant returned a code to the callback page.

4. Exchange the code for tokens with curl.

   What the server will check: A successful token exchange for your client.

5. Try the same code a second time.

   What the server will check: The second exchange was rejected.

   A code works once. A second attempt suggests it was intercepted.

6. Call UserInfo with the access token.

   What the server will check: A UserInfo request with that token.

When it opens

This lab is planned. It opens when these are in place:

• Lab setup and cleanup in your test tenant
• The lab callback page

The server checks your test tenant's history for this attempt. You can review the events yourself in your tenant's Audit and Logs.

Learn the theory

• Following the complete exchangePreparing the connection
• Roles and endpointsThe endpoints
• The authorization requestDescribing the request
• Redirects and authorization codesHandling the code
• Exchanging a code for tokensBuilding the token request
• Trust boundariesProtecting each request
• Why use the authorization code flow?