azure-auth-node.js

const msal = require('@azure/msal-node');
const app = someServer();

const authenticator = new msal.ConfidentialClientApplication({
    auth: {
        clientId: process.env.AZURE_CLIENT_ID,
        clientSecret: process.env.AZURE_CLIENT_SECRET,
        authority: `https://login.microsoftonline.com/${process.env.AZURE_TENANT_NAME}`,
    },
    system: {
        loggerOptions: {
            loggerCallback(loglevel, message, containsPii) {
                console.log(message);
            },
            piiLoggingEnabled: false,
            logLevel: msal.LogLevel.Error
        }
    }
});

const requestObject = {
    scopes: ['user.read'],
    redirectUri: `${HOST}/redirect`
};

app.get('/login', async (req, res) => {
  const loginUrl = await authenticator.getAuthCodeUrl(requestObject);
  res.redirect(loginUrl);
})

app.get('/redirect', async (req, res) => {
  const payload = await authenticator.acquireTokenByCode(
      Object.assign(requestObject, {
        code: req.query.code
      }
  );
})

/*
    
    redirect payload:

    {
        authority,
        uniqueId,
        tenantId,
        scopes,
        account: {
            homeAccountId, 
            environment, 
            tenantId, 
            username, // email
            localAccountId,
            name,
            idTokenClaims: { idToken-JWT-content }
        },
        idToken: JWT,
        idTokenClaims: { idToken-JWT-content }
        accessToken: JWT,
        fromCache: false,
        expiresOn: 2021-04-07T10:22:18.000Z,
        extExpiresOn: 2021-04-07T11:22:17.000Z,
        familyId: '',
        tokenType: 'Bearer',
        state: '',
        cloudGraphHostName: '',
        msGraphHost: ''
    }

*/