How to consume Graph API with a ADAL token?

Pierre-D Savard

in my Xamarin.forms project, I use ADAL (Microsoft.IdentityModel.Clients.ActiveDirectory) to authenticate on the Azure portal (Auth 1.0 endpoint). That part work great, but I need to get the security group of the user. So I use this code and passing the token received with ADAL:

 HttpClient client = new HttpClient();
 HttpRequestMessage message = new HttpRequestMessage(HttpMethod.Get, "https://graph.microsoft.com/v1.0/me/memberOf");
 message.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("bearer", token);
 HttpResponseMessage response = await client.SendAsync(message);
 string responseString = await response.Content.ReadAsStringAsync();

I always got StatusCode: 401, ReasonPhrase: 'Unauthorized'. In my azure AD app registration, I add the Graph API and these permissions: enter image description here enter image description here

I think I miss something. Any idea?

----- EDIT 1 --- Here my payload. I changed it for a picture for lisibility. I don't know how to post json here enter image description here

----- EDIT 2 --- OH! I see. I think I need to understand more the Azure Login process. For now I follow an example of ADAL and Azure that let my log and use some function in my backend. So the login process use:

var authContext = new AuthenticationContext(authority); var authResult = await authContext.AcquireTokenAsync(resource, clientId, uri, platformParams);

Where authority = https://login.microsoftonline.com/mysite.com, ResourceID is my backend app ID and clientID is my native app ID. So Shawn is correct, I do not use the Graph.microsoft.com to get the token. Do we have another way to achieve all that? The need of using Graph is only to get the AD group the user has to adjust permission inside the app.

Shawn Tabrizi

You are correct in your comment. If you add a new permission to your application, you must ask the user to re-consent to the app.

You can force re-consent through ADAL by setting the PromptBehavior to Always:

platformParams.PromptBehavior = PromptBehavior.Always

Or you can simply modify your Login URL to force it, by adding the query string:

&prompt=consent

In terms of building an app to help overcome this problem, if you think your app will be changing permissions after release, you can integrate logic which detects Unauthorized, and then sends the user to re-consent.

Another option is for your app to track changes which may require a new consent prompt, and detect when the user uses this new version of your application the first time, and asks them to consent.

In our new App Model V2, we support the concept of Incremental and Dynamic Consent, which should get rid of this problem all together for you.

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

ADAL Token used on server for Graph API

Azure token hasgroups: true ,Adal angular, Graph API,

ADAL.js - acquire token for Graph API resources

How to consume token based node api in to angular js

Recommended ADAL token cache for Web API?

How to consume this api?

How to consume ASP.NET Web API 2.0 with bearer token via a desktop/console application

How to consume an authenticated API with Axios

Microsoft Graph API - how to get access token without Authorization Code?

How to verify oauth token generated using Microsoft Graph API

how to use graph api access token in php for facebook sdk

How do I create an auth token with the new microsoft graph api?

How to scrape Facebook data using Graph API and the User Token?

How to add the permissions in the access token of Microsoft Graph API

How to set the access token lifetime for an app using the Microsoft Graph API

How to get Microsoft Graph API Access token from Node Script?

How to use an App Token with Facebook's Graph API

How to get Microsoft Graph API Access token using ajax call

How to get Microsoft Graph API token to read mails

Not able to get Azure token using adal4j Api

Web API on-behalf-of adal id_token error

Graph API token for developer tenent

Microsft Graph API Access Token

Consume Microsoft Graph API from backend service (node.js)

Unable to get bearer token from AAD to consume Web API

Use MSAL Auth token to consume Web API 2

How to consume jwt token in asp.net core web api for reading only user info without any validation

How to correctly renew ADAL authentication token for Server to server call

How to convert this code to scala (using adal to generate Azure AD token)