title: Azure App Services POST Access token for AuthenticationToken fails for everything but Facebook
body: <p>According to the documentation (<a href="https://azure.microsoft.com/en-us/blog/announcing-app-service-authentication-authorization/" rel="nofollow noreferrer">documentation</a>) :</p>
  <blockquote>
  <p>Your application can trigger the same redirect itself by navigating the user to the /.auth/login/ endpoint of your site, where  is one of aad, facebook, google, microsoftaccount, and twitter. This option is perfect for sites featuring a login button and for many mobile applications.</p>
  <p>Alternatively, a client can obtain a token using a provider SDK and exchange it for a session token. Simply submit an HTTP POST to the same endpoint with the provider token in a JSON body under the key “access_token” (or “authenticationToken” for Microsoft Account). This is the preferred solution for mobile applications if a provider SDK is available on the platform, and it also works for many web and API applications.</p>
  </blockquote>
  <p>I have found this <strong>ONLY</strong> works with a facebook token.  I am able to authenticate with google, facebook, twitter, and microsoft account by hitting the normal /.auth/login/{provider} endpoint.  However if you attempt to POST the resulting token from as discovered from the .auth/me endpoint or from the HTTP Headers (e.g. X-MS-TOKEN-GOOGLE-ACCESS-TOKEN, etc.) the POST endpoint only works for Facebook.</p>
  <p>I discovered the following:</p>
  <ul>
  <li><strong>Google</strong> - you'll get a HTTP/1.1 400 'authorization_code' field is required. if you follow the documentation.  However when changing the &quot;access_token&quot; name to &quot;authorization_code&quot; causes a 500 Internal Server Error</li>
  <li><strong>Twitter</strong> - undisclosed in the documentation requires an &quot;access_token_secret&quot; value in the payload in addition to the &quot;access_token&quot; value.  However including this only results in a Unauthorized 401 results - which seems to be a bug since the facebook payload works so the controller shouldn't required auth already</li>
  <li><strong>Microsoft account</strong> - Same Unauthorized 401 Error as Twitter.</li>
  </ul>