Access token return access denied when call WEB API endpoint method secured with Azure app
Setup MSAL IOS Swift app sample with Client ID (native app registered as part of the tutorial)
I am getting Unauthorised error every time I call WebAPI endpoint method in my website to retrieve user object with it's ID through postman with Key Authorisation and Value Bearer + Token (retrieved from successful Azure AD user auth),
My Value are as follows:
let kClientID = "my native app id"
// These settings you don't need to edit unless you wish to attempt deeper scenarios with the app.
let kGraphURI = "https://graph.microsoft.com/v1.0/me/"
let kScopes: [String] = ["https://graph.microsoft.com/user.read"]
let kAuthority = "https://login.microsoftonline.com/common"
PS : My Web APP authentication via Azure calling same endpoints are working fine, Issue is only with native app, i can't figure where could i be going wrong, I have spent days on it with no joy, Thanks for help in advance
azure oauth-2.0 bearer-token msal asked Nov 22 '18 at 11:40
RON12345RON12345
701310
add a comment |
Setup MSAL IOS Swift app sample with Client ID (native app registered as part of the tutorial)
I am getting Unauthorised error every time I call WebAPI endpoint method in my website to retrieve user object with it's ID through postman with Key Authorisation and Value Bearer + Token (retrieved from successful Azure AD user auth),
My Value are as follows:
let kClientID = "my native app id"
// These settings you don't need to edit unless you wish to attempt deeper scenarios with the app.
let kGraphURI = "https://graph.microsoft.com/v1.0/me/"
let kScopes: [String] = ["https://graph.microsoft.com/user.read"]
let kAuthority = "https://login.microsoftonline.com/common"
PS : My Web APP authentication via Azure calling same endpoints are working fine, Issue is only with native app, i can't figure where could i be going wrong, I have spent days on it with no joy, Thanks for help in advance
azure oauth-2.0 bearer-token msal asked Nov 22 '18 at 11:40
RON12345RON12345
701310
add a comment |
Setup MSAL IOS Swift app sample with Client ID (native app registered as part of the tutorial)
I am getting Unauthorised error every time I call WebAPI endpoint method in my website to retrieve user object with it's ID through postman with Key Authorisation and Value Bearer + Token (retrieved from successful Azure AD user auth),
My Value are as follows:
let kClientID = "my native app id"
// These settings you don't need to edit unless you wish to attempt deeper scenarios with the app.
let kGraphURI = "https://graph.microsoft.com/v1.0/me/"
let kScopes: [String] = ["https://graph.microsoft.com/user.read"]
let kAuthority = "https://login.microsoftonline.com/common"
PS : My Web APP authentication via Azure calling same endpoints are working fine, Issue is only with native app, i can't figure where could i be going wrong, I have spent days on it with no joy, Thanks for help in advance
azure oauth-2.0 bearer-token msal asked Nov 22 '18 at 11:40
RON12345RON12345
701310
Setup MSAL IOS Swift app sample with Client ID (native app registered as part of the tutorial)
I am getting Unauthorised error every time I call WebAPI endpoint method in my website to retrieve user object with it's ID through postman with Key Authorisation and Value Bearer + Token (retrieved from successful Azure AD user auth),
My Value are as follows:
let kClientID = "my native app id"
// These settings you don't need to edit unless you wish to attempt deeper scenarios with the app.
let kGraphURI = "https://graph.microsoft.com/v1.0/me/"
let kScopes: [String] = ["https://graph.microsoft.com/user.read"]
let kAuthority = "https://login.microsoftonline.com/common"
PS : My Web APP authentication via Azure calling same endpoints are working fine, Issue is only with native app, i can't figure where could i be going wrong, I have spent days on it with no joy, Thanks for help in advance
azure oauth-2.0 bearer-token msal azure oauth-2.0 bearer-token msal asked Nov 22 '18 at 11:40
RON12345RON12345
701310
asked Nov 22 '18 at 11:40
RON12345RON12345
701310
asked Nov 22 '18 at 11:40
RON12345RON12345
701310
asked Nov 22 '18 at 11:40
RON12345RON12345
701310
asked Nov 22 '18 at 11:40
RON12345RON12345
701310
701310
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
I guess your request contained the parameter "client_secret",whereas for native app,it is not required,another reason is that the access token does not contain the impersonation permissions required to access the resource,impersonation permissions granted to the native client application. The default permission is user_impersonation. The owner of the target resource can register alternate values in Azure AD,you can also click this link and search "native" to find out the reason,hope it benefit.
answered Nov 26 '18 at 6:59
SteveSteve
14
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53430223%2faccess-token-return-access-denied-when-call-web-api-endpoint-method-secured-with%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
I guess your request contained the parameter "client_secret",whereas for native app,it is not required,another reason is that the access token does not contain the impersonation permissions required to access the resource,impersonation permissions granted to the native client application. The default permission is user_impersonation. The owner of the target resource can register alternate values in Azure AD,you can also click this link and search "native" to find out the reason,hope it benefit.
answered Nov 26 '18 at 6:59
SteveSteve
14
add a comment |
I guess your request contained the parameter "client_secret",whereas for native app,it is not required,another reason is that the access token does not contain the impersonation permissions required to access the resource,impersonation permissions granted to the native client application. The default permission is user_impersonation. The owner of the target resource can register alternate values in Azure AD,you can also click this link and search "native" to find out the reason,hope it benefit.
answered Nov 26 '18 at 6:59
SteveSteve
14
add a comment |
I guess your request contained the parameter "client_secret",whereas for native app,it is not required,another reason is that the access token does not contain the impersonation permissions required to access the resource,impersonation permissions granted to the native client application. The default permission is user_impersonation. The owner of the target resource can register alternate values in Azure AD,you can also click this link and search "native" to find out the reason,hope it benefit.
answered Nov 26 '18 at 6:59
SteveSteve
14
I guess your request contained the parameter "client_secret",whereas for native app,it is not required,another reason is that the access token does not contain the impersonation permissions required to access the resource,impersonation permissions granted to the native client application. The default permission is user_impersonation. The owner of the target resource can register alternate values in Azure AD,you can also click this link and search "native" to find out the reason,hope it benefit.
answered Nov 26 '18 at 6:59
SteveSteve
14
answered Nov 26 '18 at 6:59
SteveSteve
14
answered Nov 26 '18 at 6:59
SteveSteve
14
answered Nov 26 '18 at 6:59
SteveSteve
14
14
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53430223%2faccess-token-return-access-denied-when-call-web-api-endpoint-method-secured-with%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
