MS Graph API: invalid authentication token

Question

I'm trying to use the Microsoft Graph API to query an Outlook/O365 mailbox for messages. I registered my app in the Azure portal and received the necessary information to query the API. The app has the Mail.Read permission. (I don't have access to the Azure portal, I was told it was set up this way.) When I get my token from the OAuth endpoint, however, it doesn't work in any subsequent calls. I'm using Python's requests module for testing right now.

Why is this call failing? It seems like I'm passing all of the correct information but I'm clearly missing something.

I'm getting the token by performing a POST on:

https://login.microsoftonline.com/my.domain/oauth2/token

I pass the necessary parameters:

data = {'grant_type': 'client_credentials', 'client_id': CLIENTID, 'client_secret': SECRET, 'resource': APPURI}

and I get a response like this:

{
    'resource': 'APPURI',
    'expires_in': '3599',
    'ext_expires_in': '3600',
    'access_token': 'TOKENHERE',
    'expires_on': '1466179206',
    'not_before': '1466175306',
    'token_type': 'Bearer'
}

I try to use that token, however, and it doesn't work for anything I call. I'm passing it as a header:

h = {'Authorization': 'Bearer ' + TOKEN}

I'm calling this URL:

url = 'https://graph.microsoft.com/v1.0/users/[email protected]/messages'

Specifically, I use this:

r = requests.get(url, headers=h)

The response is a 401:

{
    'error': {
        'innerError': {
            'date': '2016-06-17T15:06:30',
            'request-id': '[I assume this should be removed for privacy]'
         },
         'code': 'InvalidAuthenticationToken',
         'message': 'Access token validation failure.'
     }
}

user2641043 · Accepted Answer · 2017-02-08 14:49:29Z

19

in your login request, the resource parameter should be https://graph.microsoft.com

answered Feb 8, 2017 at 14:49

user2641043

4053 silver badges12 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Raphael Z · Accepted Answer · 2017-12-18 20:08:10Z

5

It seems to be the case, that tokens issued from the v1 endpoint aren't valid for atleast some requests with MS Graph API.

Instead try to get the token form the v2 endpoint by calling https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token.

In case you are working with oidc discovery documents, you'll find the one for v2 at https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration

answered Dec 18, 2017 at 20:08

Raphael Z

1911 silver badge6 bronze badges

Comments

Xiaomin Wu · Accepted Answer · 2016-06-17 17:11:28Z

1

I think you will need to register app from here "https://apps.dev.microsoft.com" instead of from Azure Portal.

answered Jun 17, 2016 at 17:11

Xiaomin Wu

3,7951 gold badge18 silver badges14 bronze badges

1 Comment

Amit Over a year ago

This won't be of help. The page says - "Application registrations portal has been deprecated for registering and managing converged applications since May 2019 and this functionality will be removed starting September 2019. We recommend that you manage your existing applications and register new applications by using the App registrations (now Generally Available) experience in the Azure portal."

Marc LaFleur · Accepted Answer · 2017-10-13 19:47:34Z

1

Unless you are an using Client Credentials, you cannot access the messages another account's mailbox. Make sure that [email protected] is the same account you are authenticated with and that this address is also the userPrincipalName for the account.

You can also use a simplified URI for requesting your messages and bypassing determining the account's userPrincipalName by using /me. In this case the GET request would be https://graph.microsoft.com/v1.0/me/messages

edited Oct 13, 2017 at 19:47

answered Jun 17, 2016 at 17:08

Marc LaFleur

33.4k4 gold badges41 silver badges71 bronze badges

10 Comments

vaindil Over a year ago

I'm trying to set up a task on my web app that will periodically check a specific mailbox for new emails and process attachments on them. Sounds like I'm going about it the wrong way then.

Marc LaFleur Over a year ago

This will work but you'll need to either get a token using that mailbox's credentials or use an account with administrative privileges.

vaindil Over a year ago

Hope it's okay to piggyback off of this. We can't figure out where to generate the credentials under the account; can't log into the portal because it's not an administrator account. Where would we do that?

vaindil Over a year ago

The app information created in the URL provided in the other answer by Xiaomin returns this from the oauth endpoint: Application 'IDHERE' is not supported for this API version. Must not be the correct way to do it.

vaindil Over a year ago

Let us continue this discussion in chat.

|

Yvan Aquino · Accepted Answer · 2017-07-18 14:38:08Z

0

It's worth noting that even if MS's Azure documentation does not specify the need for listing the resource, I could never get to work without listing the resource.

https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols-oauth-client-creds.

There is a supplementary document specifiy to two-legged Auth for MS Graph that actually uses the 'resource' in the example.

https://developer.microsoft.com/en-us/graph/docs/authorization/app_only

Happy hunting!

answered Jul 18, 2017 at 14:38

Yvan Aquino

1166 bronze badges

1 Comment

Karthik Rana Over a year ago

How to specify more than one resource there ?

Collectives™ on Stack Overflow

MS Graph API: invalid authentication token

5 Answers 5

Comments

Comments

1 Comment

10 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

Comments

Comments

1 Comment

10 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related