Graph API Client token authentication issue

Question

My website is using the GraphClient Library (http://www.nuget.org/packages/Microsoft.Azure.ActiveDirectory.GraphClient) to query Azure AD. Its using its own credentials and authorization token to access graph.windows.net and this works fine.

I'm trying to change it so that when users log into my website and authenitcate using their own Microsoft tenant account, my website then queries the graph.windows.net using that users token and not its (the webserver) own.

I'm using OWIN middleware, OpenID against Microsoft for authentication and finally the GraphClient to query AzureAD.

Right now my process is in OWIN Notifications => AuthorizationCodeReceived I do a AcquireTokenByAuthorizationCode() to retrieve the users AccessToken, then I try connect to the GraphClient like so..

new ActiveDirectoryClient(
  new Uri(graphResourceID + '/' + tenantID),
  async () => userAccessToken
)

The GraphClient always returns a response saying 'insufficient privileges' to all the calls I checked. But if I create a simple HTTPClient request to the graph.windows.net REST API and inject the "Bearer" authoriaztion header with userAccessToken from above then the Graph API gives me a valid response.

Why is the GraphClient library returning 'insufficient privileges' when a simple HTTPClient request works fine?

Thomas · Accepted Answer · 2016-01-26 00:55:50Z

1

Connecting to your Azure Active Directory, you should be able to configure the permissions for your application :

answered Jan 26, 2016 at 0:55

Thomas

30.5k6 gold badges99 silver badges143 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Graph API Client token authentication issue

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related