I am trying to have access to information in "/me" with Graph API for a personal account using Azure AD v2.0 but I receive the following error. It works with organizational accounts.
{
"error": {
"code": "UnknownError",
"message": "{\"Status\":500,\"Message\":\"All the offeractions povided in the property bag cannot be validated for the token.\\u000d\\u000a\"}",
"innerError": {
"request-id": "39e23062-80ad-4872-86a7-39f5a5d928ce",
"date": "2017-02-23T15:35:06"
}
}
}
I have the permission User.ReadBasic.All
The scope User.ReadBasic.All grant the permission to read the basic profile of all users in the organization on behalf of the signed-in user. This scope is t only supported for the Azure AD Account. If you just want to read the user’s profile for the Microsoft Account, you could use the scope User.Read . Code flow steps below is for your reference :
Get the authorization code :
Get : https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=code&client_id=<client id>&redirect_uri=http%3A%2F%2Flocalhost%3A16468%2F&scope=https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&state=af0ifjsldkj&nonce=n-0S6_WzA2Mj
Then get the token :
POST https://login.microsoftonline.com/common/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded
grant_type=authorization_code&code=<code>&state=af0ifjsldkj&redirect_uri=http%3A%2F%2Flocalhost%3A16468%2F&client_id=<client id>&client_secret=<client secret>
Related
I am trying to access Microsoft Graph API using Access token of b2c login.
Following are the endpoints azure portal showing.
As I feel we must be able to call https://graph.microsoft.com endpoints according to this. Please correct me if I am wrong. Then I generated access token as follows and Tried to call https://graph.microsoft.com/v1.0/me/ using that token.
The result is as follows.
{
"error": {
"code": "InvalidAuthenticationToken",
"message": "Access token validation failure.",
"innerError": {
"date": "2020-08-25T11:58:07",
"request-id": "c6a9ba06-d41e-49f7-ba94-f75478ce89b0"
}
}
}
I have granted API permissions as follows in my application too
This wont work. Use the Azure AD flows in your AAD B2C tenant.
https://learn.microsoft.com/en-us/graph/auth-v2-service
I am working on daemon service that retrieves the list of contacts from Microsoft Graph, that does not prompt Microsoft Authentication to the user. However, I'm not able to retrieve the permissions I set in Microsoft Azure even with granted admin consent.
I use Postman to generate a token with the following information.
https://login.microsoftonline.com/0835055b-8a00-4130-b07a-037430dd000d/oauth2/v2.0/token
The following json is the result I get
{
"token_type": "Bearer",
"scope": "profile openid email https://graph.microsoft.com/User.Read https://graph.microsoft.com/.default",
"expires_in": 3600,
"ext_expires_in": 3600,
"access_token": "{MY_TOKEN_HERE}"
}
Token is generated successfully but the token returned does not include the permission with granted admin consent I set in MS Azure at portal.azure.com > Registered App > API Permission.
I have Microsoft Graph - Users.Read and Contacts Read with green ticks on admin consent required. See image below:
Microsoft Azure - API Permission
And without the scope, I'm not able to retrieve the list of contacts with given token.
{
"error": {
"code": "ErrorAccessDenied",
"message": "Access is denied. Check credentials and try again.",
"innerError": {
"request-id": "63a24a22-34f7-42a1-a9d5-d7aaf598f4d6",
"date": "2019-07-01T02:59:15"
}
}
}
Is there anything I missed? I assumed when the admin has granted consents, I should be able to include the API in scopes to generate tokens.
I saw there is a similar issue here but there is no solutions that work for me:
Microsoft graph API: Unable to fetch users with the generated access token
Based on your screenshot, the contacts.read you granted is an application permission. And, you have only one delegated permission: user.read .
However, if you want to call the graph api : graph.microsoft.com/v1.0/me/contacts , you need to use delegated permission. It will represent the user. So you can get the information for "me". And based on the official documentation , you need to grant the Contacts.Read (Contacts.ReadWrite for writing) delegated permission.
If you want to use application permission, then you need to get access token with client credentials flow. Token got in this way can be used for application permission. And you should call the api as following : graph.microsoft.com/v1.0/users/{id | userPrincipalName}/contacts
I am trying to automate deployment of B2C TrustFramework policies and keysets.
For Custom policies, everything works as expected but I am having some problem listing keySets using the Graph API.
I've created a local user with B2C IEF Keyset administrator and B2C IEF Policy administrator roles.
I've created an app registration with these delegated permissions: Policy.ReadWrite.TrustFramework, TrustFrameworkKeySet.Read.All, TrustFrameworkKeySet.ReadWrite.All
Calling the AAD Token endpoint, I am able to get an access_token with the desired scopes for the graph api resource.
I am trying then to call the List KeySets endpoint using the access_token (as bearer token in the authorization hearder)
GET https://graph.microsoft.com/beta/trustFramework/keySets HTTP/1.1
Authorization: Bearer {{my access_token}}
And I am getting this response from the Graph API (403 Forbidden):
```
{
"error": {
"code": "AADB2C",
"message": "Unauthorized. Access to this Api requires feature: 'EnableIEFKeySetGraphApis' for the tenant: 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'.",
"innerError": {
"correlationId": "4674e4c9-933e-4e70-a26b-ed59e40dc088",
"date": "2019-06-04T08:55:32",
"request-id": "d796beda-62be-46a8-afa2-cf53d29409b5"
}
}
}
```
This tenant was created before Custom Policies went GA (so not sure if it is related) but how do I activate the EnableIEFKeySetGraphApis feature ?
There is a private Preview Sample available in GitHub for Graph API Key Sets.
https://github.com/Azure-Samples/ActiveDirectory-B2C-MSGraph-PolicyAndKeysets
try this and see you able to list your keysets or not.
I set up a new Application in microsoft azure and got the admin to consent application permissions for this app ( files.ReadWriteAll). I am able to get the access_token through POSTMAN. I am trying to get drive information using this endpoint
https://graph.microsoft.com/v1.0/drives/{drive-id}
But I get an error response :-
{ "error": { "code": "AccessDenied", "message": "Either scp or roles claim need to be present in the token.", "innerError": { "request-id": "905c7701-8b89-4711-9204-b00c4a09a921", "date": "2019-03-28T15:56:29" } } }
I used this link to get info on my access token.
http://jwt.calebb.net/
Files.Readwrite permissions don't seem to be listed anywhere in the info ( not sure why) . The azure site shows that consent was granted.
Azure permissions set up for my app:
Check the steps as below.
Register your app following this document, and Grant permissions.
get access token like this.
Check the token
Call graph api
I am using Azure ad B2c development Web app,I want use the graph api (msgraph) to get and set the user's group.So,I create a azure ad b2c service name is B2Ctest,and B2CTest based azure ad service name is Adtest.
I use this api Microsoft Graph Client Library for .NET and used Adtest setting msgraph.
I get the B2Ctest service's user token, and passing the token to msgraph get the user own's group.It's throw a exception.
I catch msgraph post http packet.
address:
https://graph.microsoft.com/v1.0/groups
response:
{
"error": {
"code": "InvalidAuthenticationToken",
"message": "Access token validation failure.",
"innerError": {
"request-id": "e715c5f9-5c2c-40d8-ad09-71c848205d2c",
"date": "2017-10-09T16:10:20"
}
}
}
aad b2c access token
aad access token
I found,that aad b2c access token and aad access token are not the same.