@emulators/microsoft
Microsoft Entra ID (Azure AD) v2.0 OAuth 2.0 and OpenID Connect emulation with authorization code flow, PKCE, client credentials, client-bound refresh tokens, RS256 ID tokens, and OIDC discovery.
Part of emulate — local drop-in replacement services for CI and no-network sandboxes.
Install
npm install @emulators/microsoft
Endpoints
GET /.well-known/openid-configuration— OIDC discovery documentGET /:tenant/v2.0/.well-known/openid-configuration— tenant-scoped OIDC discoveryGET /discovery/v2.0/keys— JSON Web Key Set (JWKS)GET /oauth2/v2.0/authorize— authorization endpoint (shows user picker)POST /oauth2/v2.0/token— token exchange (authorization code, refresh token, client credentials)GET /oidc/userinfo— OpenID Connect user infoGET /v1.0/me— Microsoft Graph user profileGET /v1.0/users/:id— Microsoft Graph user by IDGET /oauth2/v2.0/logout— end session / logoutPOST /oauth2/v2.0/revoke— token revocation
Auth
OIDC authorization code flow with PKCE support. Also supports client credentials grants. When OAuth clients are configured, refresh tokens can only be used with the client that received them and valid client credentials. Legacy refresh records without a stored client binding remain supported. Microsoft Graph /v1.0/me available.
Refresh Tokens
curl -X POST http://localhost:4005/oauth2/v2.0/token \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "refresh_token=r_microsoft_...&\
client_id=example-client-id&\
client_secret=example-client-secret&\
grant_type=refresh_token"
Refresh requests require the client_id and client_secret of the client that received the refresh token. The token rotates after a successful request. Authorization: Basic may be used for the client credentials.
Seed Configuration
microsoft:
users:
- email: [email protected]
name: Test User
oauth_clients:
- client_id: example-client-id
client_secret: example-client-secret
name: My Microsoft App
redirect_uris:
- http://localhost:3000/api/auth/callback/microsoft-entra-id