title: Authenticating with ADAL JS not behaving as expected
body: <p>I have two Azure AD applications in the same directory, let’s call them <code>FrontendAuth</code> and <code>BackendAuth</code>, which provide authentication for an ASP.NET MVC frontend and a Web API backend, respectively. The MVC frontend is protected using the standard <code>UseOpenIdConnectAuthentication</code> configuration, the Web API backend with <code>UseWindowsAzureActiveDirectoryBearerAuthentication</code>.</p>
  
  <p>What I want to do is log into the frontend, authenticate against <code>FrontendAuth</code>, then consume via JavaScript the API hosted in the backend by providing a token, acquired using <code>ADAL JS</code>, to <code>BackendAuth</code>.</p>
  
  <p><strong>Assumptions</strong></p>
  
  <p>My expectations/assumptions are:</p>
  
  <ul>
  <li>That I would have to configure <code>FrontendAuth</code> to have access to <code>BackendAuth</code> in the classic portal</li>
  <li>That I would have to edit the manifest files of one or both of these to set <code>oauth2AllowImplicitFlow</code> to <code>true</code></li>
  <li>That when I configure <code>ADAL JS</code> I should be setting <code>clientId</code> to be that of <code>FrontendAuth</code></li>
  <li>The <code>endpoints</code> object of the <code>ADAL JS</code> configuration should contain the Url of the backend API and the client ID of <code>BackendAuth</code></li>
  </ul>
  
  <p><strong>Outcome</strong></p>
  
  <p>I can achieve my goal of logging in to the frontend and communicating with the backend service via <code>ADAL JS</code> with:</p>
  
  <ul>
  <li>The <code>FrontendAuth</code> application having no access to <code>BackendAuth</code> at all</li>
  <li>Neither manifest file having the <code>oauth2AllowImplicitFlow</code> property set to <code>true</code></li>
  <li><code>ADAL JS</code> having the <code>clientId</code> set to be that of <code>BackendAuth</code></li>
  <li>The endpoints object of the <code>ADAL JS</code> configuration not set at all</li>
  </ul>
  
  <p><strong>Questions</strong></p>
  
  <p>Based on these findings I would like to understand the following:</p>
  
  <ul>
  <li>Were my assumptions correct? Is this how <code>ADAL JS</code> is intended to work?</li>
  <li>Why did the lack of application access and unchanged manifest files have no effect on whether the authentication succeeded?</li>
  <li>When do these measures have an effect on the authentication outcome?</li>
  </ul>