I'm trying to POST or PATCH an education class using Microsoft Graph but always get and error.
Request
https://graph.microsoft.com/V1.0/education/classes
{
"description": "Health Level 1",
"classCode": "Health 501",
"displayName": "Health 1",
"externalId": "11019",
"externalName": "Health Level 1",
"externalSource": "sis",
"mailNickname": "fineartschool.net"
}
Response
{
"code": "AccessDenied",
"message": "Required scp claim values are not provided.",
"innerError": {
"request-id": "e1183015-d942-491a-9949-4aa73bbef893",
"date": "2018-06-21T08:44:35"
}
}
My App has the needed permissions for creating an education class. (for testing, my app has all the application and delegated permissions possible). Posting users, groups etc is no problem.
More specific the needed permission:
After assigning the permission in the AD portal I did the following:
Get admin consent for the app https://login.microsoftonline.com/myTenant/adminconsent?client_id=myClientID&redirect_uri=MyRedirectURI
Get the authorization code https://login.microsoftonline.com/myTenant/oauth2/authorize?client_id=myClientID&response_type=code&redirect_uri=MyRedirectURI&response_mode=query&resource=https://graph.microsoft.com/
Get the access token
All with success.
After getting the Access Token I have the following scopes:
.....
EduRoster.Read
EduRoster.ReadBasic
EduRoster.ReadWrite
...
The Graph documentation says you need the permission Application EduRoster.ReadWrite.All
Also tested a POST and PATCH in Graph Explorer but get the same response.
This API requires "Application" rather than "Delegated" scopes. As you mentioned, it specifically requires the EduRoster.ReadWrite.All scope.
Which scopes get applied to a token depends entirely on which OAuth Grant you used to obtain the token:
Authorization Code Grant = Delegated
Implicit Grants = Delegated
Client Credentials Grant = Application
The reason you're not getting this scope in your Access Token is that you're using the Authorization Code grant (response_type=code) which will always result in Delegated scopes getting assigned.
In order to make this call, you'll need to obtain a token using the Client Credentials grant.
You might also find this article helpful (full disclosure, I am the author): Application vs Delegated Scopes.
Related
I am attempting to use the "List Contacts" Microsoft Graph v1.0 API (https://learn.microsoft.com/en-us/graph/api/user-list-contacts?view=graph-rest-1.0) to retrieve the contacts of various users in my organization. In other words I want to list contacts in a delegated fashion.
My problem is that this API only seems to work for the user associated with the access token, e.g.:
Get Microsoft Graph API token for user "A"
Request to https://graph.microsoft.com/v1.0/users/USER_A_ID/contacts works fine
Request to https://graph.microsoft.com/v1.0/users/USER_B_ID/contacts fails
The error returned by the API is:
{
"error": {
"code": "ErrorAccessDenied",
"message": "Access is denied. Check credentials and try again.",
"innerError": {
"request-id": "[REQUEST_ID]",
"date": "[DATE]"
}
}
}
I have verified that the token contains the "Contacts.Read" scope by decoding the JWT token and examining the "scp" field, so I do not understand why the APIs saying that access is denied. Any ideas as to why this is failing?
Your need Contacts.Read.Shared or Contacts.ReadWrite.Shared, Your current Contacts.Read scope will only allow you to access the current users Contacts Folder. The other thing is the user requesting will still need to be granted the underlying delegate rights to the Target Mailbox Folder ( via Outlook delegation or Add-MailboxFolderPermission eg they need to be able to access the folder via Outlook or OWA).
I have registered the application in Azure portal and i have generated the client_secret.
I require the client grant flow and i have given application permissions also. I have granted the admin consent also as I am the admin myself.
I am able to generate the access token with the given url:
https://login.microsoftonline.com/47be0abf-c6a1-4f04-a665-dceb081c4ff1/oauth2/v2.0/token?client_id=********&client_secret=******&grant_type=client_credentials&scope=User.ReadBasic.All%20User.Read%20User.ReadWrite%20User.Read.All%20User.ReadWrite.All%20Directory.Read.All%20Directory.ReadWrite.All%20Directory.AccessAsUser.All
However, when i use the token generated to access the following url, I get the insufficient privileges message.
https://graph.microsoft.com/v1.0/users
Authorization Bearer eyJ0eXAiOiJKV1QiLCJub25jZSI6IkFRQUJBQUFBQUFEQ29NcGpKWHJ4VHE5Vkc5dGUtN0ZYNndkRlV3aTBKbGlHcWhEWkgybFRlYWh6SUhUX0VsazFaYTFuUHRzNWo3SW5xMDBmbnNNRkpNUWRYdWdVZnpaZ0cxT19uenNPTXpwN2tpUFFIR2VHTnlBQSIsImFsZyI6IlJTMjU2IiwieDV0IjoiQ3RmUUM4TGUtOE5zQzdvQzJ6UWtacGNyZk9jIiwia2lkIjoiQ3RmUUM4TGUtOE5zQzdvQzJ6UWtacGNyZk9jIn0.eyJhdWQiOiJodHRwczovL2dyYXBoLm1pY3Jvc29mdC5jb20iLCJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC80N2JlMGFiZi1jNmExLTRmMDQtYTY2NS1kY2ViMDgxYzRmZjEvIiwiaWF0IjoxNTYwMjUzMDE1LCJuYmYiOjE1NjAyNTMwMTUsImV4cCI6MTU2MDI1NjkxNSwiYWlvIjoiNDJaZ1lQajhVdnBwWGMySEU1WGZwbnZxSG43akFnQT0iLCJhcHBfZGlzcGxheW5hbWUiOiJUdXRvcmlhbCBTYW1wbGUgQXBwIiwiYXBwaWQiOiI2NzMxZGU3Ni0xNGE2LTQ5YWUtOTdiYy02ZWJhNjkxNDM5MWUiLCJhcHBpZGFjciI6IjEiLCJpZHAiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC80N2JlMGFiZi1jNmExLTRmMDQtYTY2NS1kY2ViMDgxYzRmZjEvIiwib2lkIjoiNjg0ZjkzMjUtNjUyNS00Yjk5LTgwNzktOTEyOGZjZWNlNGViIiwic3ViIjoiNjg0ZjkzMjUtNjUyNS00Yjk5LTgwNzktOTEyOGZjZWNlNGViIiwidGlkIjoiNDdiZTBhYmYtYzZhMS00ZjA0LWE2NjUtZGNlYjA4MWM0ZmYxIiwidXRpIjoiSkZjUE9SSHRGVTJMMWludEpkY2RBQSIsInZlciI6IjEuMCIsInhtc190Y2R0IjoxMzQ0Njc5MzA0fQ.fXEs7eClm5SYXychcKXbTfcc5gtvyyMa5fDWuGu2vqQ4Zc6V0jJSHSeksRiOzYE8SOJXRTmI9vJtbs2XIMFr0CRHeTgoCDReV8JWJ8yhOKiDnc-_2AHtSoBnqt6ibF0eX4AzkyioJd24-uYTSkheC_zDpd6GS3T5T077BU_1M7kpngXDfEICi38VkddcpdBUG8FgHUSPq0S9fCosIB4_JPwspq3QC6jJyoRrj1Yj2oR8FwBA1dpgWq_e0QoGnWXgT6EhBKedjY0hwHGY-F73ndvRlAKKW63JYucdOtRyC2zFDc4DPwhN1nyPlh86_Y0Zru8UTb0QgWRFKbGZwQcEOg
I have tried changing the permission and added and removed the permissions.
{
"error": {
"code": "Authorization_RequestDenied",
"message": "Insufficient privileges to complete the operation.",
"innerError": {
"request-id": "aa38f822-7325-44ad-9127-3cb4779578bf",
"date": "2019-06-11T11:42:16"
}
}
}
Updated : Included the permission screenshot configuration
JWT Debugger output for tokens:
{
"aud": "https://graph.microsoft.com",
"iss": "https://sts.windows.net/f77804fb-8607-4e96-9fae-231360cc82b7/",
"iat": 1560273380,
"nbf": 1560273380,
"exp": 1560277280,
"aio": "42ZgYKjulnV3u/vJZNN0gz3ld2ZpAwA=",
"app_displayname": "clmapp",
"appid": "82ad79f2-27c7-4304-92f6-e3ffdb637e72",
"appidacr": "1",
"idp": "https://sts.windows.net/f77804fb-8607-4e96-9fae-231360cc82b7/",
"tid": "f77804fb-8607-4e96-9fae-231360cc82b7",
"uti": "BpTbRLEb5ECSO3qjslIgAA",
"ver": "1.0",
"xms_tcdt": 1376441181
}
You could try following way:
Permission:
Make sure you have following permission:
Grant permission On Azure Portal:
Step:1
Select Application Permission On API permissions menu
Step:2
Select User.ReadWrite.All under Application Permission part But User.Read.All also alright.
Token Request Format:
URL:https://login.microsoftonline.com/YourTenant.onmicrosoft.com/oauth2/token
For V2.0 URL:https://login.microsoftonline.com/YourTenant.onmicrosoft.com/oauth2/v2.0/token
HTTP Verb: POST
grant_type:client_credentials
client_id:b603c7be-a866-4-e6921e61f925
client_secret:Vxf1SluKbguf3wE5oGl/2XDSeZ8wL/Yp8ns4sc=
resource:https://graph.microsoft.com
For V2.0 scope Will be : scope:https://graph.microsoft.com/.default
See the screen shot below:
Decode Token & Confirm permission:
You can use https://jwt.io/ to decode your token to make sure you have required permission: See the below screen shot:
Request For User List:
With your Token Request on this endpoint https://graph.microsoft.com/v1.0/users. See the screen shot below. I have successfully get all the user list.
When using the OAuth 2.0 Client Credentials Grant flow, your scope value should use the built-in .default scope for the resource your are trying to access. This is mentioned in the reference article: Microsoft identity platform and the OAuth 2.0 client credentials flow
In your case, the resource you are trying to access is Microsoft Graph, so your scope value in the token request should be https://graph.microsoft.com/.default:
https://login.microsoftonline.com/{tenant-id-or-domain}/oauth2/v2.0/token
&grant_type=client_credentials
&client_id={client-id}
&client_secret={client-secret}
&scope=https%3a%2f%2fgraph.microsoft.com%2f.default
Note that for this to succeed, the app's required permissions must be configured (Azure portal > Azure Active Directory > App registrations > API permissions) and granted:
Having issues accessing graph resources for a specific user. Most have no issues. This specific user authenticates with our client via their school Outlook account which I am assuming is where the issue lies.
Our service attempts to create a specific folder using the /me/contactFolders endpoint. When we make the post, we get the error that the resource could not be discovered. Digging in a bit, I decided to login with their account to the Graph explorer and could not query endpoints such as, /me/contacts, /me/contactFolders, /me/events, etc.. None of the examples provided worked to fetch any data. I am assuming this has to do with permissioning of the users account, but I am not sure what permissions they would need to access both calendars and contacts (we are setting scopes and delegated permissions correctly as this problem is only associated with a couple users).
This is the error message that I received when trying to query graph:
{
"error": {
"code": "ResourceNotFound",
"message": "Resource could not be discovered.",
"innerError": {
"request-id": "5cfd7b28-a915-42cf-9bce-a8a2509c3f1f",
"date": "2018-12-20T18:48:34"
}
}
}
Any help in diagnosing this issue would be greatly appreciated!!
If you couldn't decode the token then you're most likely facing one of the following issues:
You obtained the token incorrectly
You're attempting to decode the Authorization Code rather than the Access Token (i.e. the string you get from 1st OAuth step rather than the 2nd).
The token is for Microsoft Account (a.k.a. MSA, lesser aka as an Xbox or Outlook.com account).
You can only decode tokens issued by Azure AD (AAD). School accounts (i.e. those ending in .edu) are basically the same as Work accounts, they're owned and managed by an Azure Active Directory.
In terms of checking which services are provisioned for the current User, you can obtain these from the /me endpoint so long as you have requested either the User.Read or User.ReadWrite scope. Note that this information isn't included by default so you'll need to specifically request the provisionedPlans. For example, the following query will return the current user's id, userPrincipalName, and their list of provisionedPlans (i.e. services):
https://graph.microsoft.com/v1.0/me/?$select=id,userPrincipalName,provisionedPlans
The results are pretty self-explanatory but in your particular case you're looking for a service named exchange (there are often more than one but they should all reflect the same status):
{
"#odata.context": "https://graph.microsoft.com/v1.0/$metadata#users(id,userPrincipalName,provisionedPlans)/$entity",
"id": "48d31887-5fad-4d73-a9f5-3c356e68a038",
"userPrincipalName": "MeganB#M365x214355.onmicrosoft.com",
"provisionedPlans": [
{
"capabilityStatus": "Enabled",
"provisioningStatus": "Success",
"service": "exchange"
},
I am trying to fetch auditDetails of YouTube channels.
As per official API docs (https://developers.google.com/youtube/v3/docs/channels/list) I am supposed to provide an authorization token that contains the https://www.googleapis.com/auth/youtubepartner-channel-audit scope.
Authorization
A request that retrieves the auditDetails part for a channel resource must provide an authorization token that contains the https://www.googleapis.com/auth/youtubepartner-channel-audit scope. In addition, any token that uses that scope must be revoked when the MCN decides to accept or reject the channel or within two weeks of the date that the token was issued.
I am currently trying to fetch a YouTube channel's auditDetails by hitting following URL:
https://www.googleapis.com/youtube/v3/channels?key=xxxxxxxxxx&id=UC9eSXrzVl9ZFLwsNSBgvTog&part=auditDetails
But, it is returning an Insufficient Permission error as follows:
{
"error": {
"errors": [
{
"domain": "global",
"reason": "insufficientPermissions",
"message": "Insufficient Permission"
}
],
"code": 403,
"message": "Insufficient Permission"
}
}
Can someone suggest me an approach to generate youtubepartner-channel-audit scope for various YouTube channels.
The error you have encountered means that:
The OAuth 2.0 token provided for the request specifies scopes that are
insufficient for accessing the requested data.
You can request for authorization of auditDetails part for channel resource:
Must provide an authorization token that contains the
https://www.googleapis.com/auth/youtubepartner-channel-audit scope. In
addition, any token that uses that scope must be revoked when the MCN
decides to accept or reject the channel or within two weeks of the
date that the token was issued.
After that, you can add your scope to the OAuth sign-in request.
In order to introduce scopes, an authorization token containing those scopes needs to be created.
Authorization credentials can be created via the Credentials page in the API Console.
Create credentials
But before creating OAuth client ID authorization credentials, user is required to set a product name on the consent screen.
On the consent screen itself user can add multiple scopes as per application requirement.
Add scope
I'm trying to build an application that uses Microsoft Graph to automatically create and read pages in OneNotes stored in SharePoint 365.
I can successfully do this using Graph Explorer as long as I am logged in, but can't get it to work using a bearer token in Postman
The error I am getting is:
Either scp or roles claim need to be present in the token
I successfully get an access token using this:
https://login.microsoftonline.com/common/oauth2/v2.0/token
And passing in the grant_type, client_id, client_secret, code, redirect_uri and scope
Then I perform the following call, with the bearer token included in the header:
https://graph.microsoft.com/v1.0/sites
With the following getting returned:
{
"error": {
"code": "AccessDenied",
"message": "Either scp or roles claim need to be present in the token.",
"innerError": {
"request-id": "fa442c72-4ffe-493b-a33a-8e9e78c94f09",
"date": "2018-01-19T09:56:34"
}
}
}
I have set up graph permissions as per below. I have also tried enabling ALL Notes permissions configured with the same result though
Graph Permissions Image
One post I found said to check http://jwt.calebb.net/ what is returned in the token, and I found that it doesn't contain any roles, so I wonder if this is the problem.
You may need to state your tenant in the url when getting the token :
https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
Thanks to Tsuyoshi Matsuzaki as seen here : How to use Application Permission with Azure AD v2
Your application can get access token using the following HTTP request
(OAuth). Note that you cannot use
https://login.microsoftonline.com/common/oauth2/v2.0/token (which is
commonly used) for getting the token. Instead, you must use
https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token, which
identifies the specific tenant.
The call that you mentioned "https://graph.microsoft.com/v1.0/sites" is not valid.
Also request to ~/sites/... routes may need other permissions in addition to Notes.ReadWrite.
Recommend to follow steps mentioned in the following references:
https://developer.microsoft.com/en-us/graph/docs/concepts/permissions_reference
https://developer.microsoft.com/en-us/graph/docs/concepts/auth_v2_user
https://developer.microsoft.com/en-us/graph/docs/concepts/auth_v2_service