How do request a correct access token in ASP.NET Core for Azure AD to access Microsoft Graph

Question

I've an ASP.NET Core application using ASP.NET Core Identity and trying to authenticate against Azure AD.

services.AddAuthentication()
    .AddOpenIdConnect("AzureAD", "Azure AD", option =>
    {
        option.ClientId = Configuration["AzureAD:AppId"]; 
        option.ClientSecret = "abc";
        option.Authority = string.Format(Configuration["AzureAd:AadInstance"], Configuration["AzureAd:Tenant"]);
        option.SignedOutRedirectUri = Configuration["AzureAd:PostLogoutRedirectUri"];
        option.ResponseType = OpenIdConnectResponseType.CodeIdToken;
        option.SaveTokens = true;
        option.SignInScheme = IdentityConstants.ExternalScheme;
        option.Events = new OpenIdConnectEvents
        {
            OnRemoteFailure = OnAuthenticationFailed,                       
        };
    });

Everything works fine, the user can login using its credentials.

Now i'm trying to access Microsoft Graph in order to receive the user's email address (it's not send as claim in the id_token). But when I use the received access_token from the login flow the Graph aPI returns an error:

Code: InvalidAuthenticationToken
Message: CompactToken parsing failed with error code: -2147184105

When I look at the access_token it looks weird. It's not a valid JWT. AQABAAAAAABHh4kmS_aKT5XrjzxRAtHzymKlkayx9UvCfyg_uHq1prmSP8f0Mi5BfiqkdIZeqJsBbm9SSbDbMrQ0JgNa6pa6M97IjVr6ZHdtt3ryT8vns_kz5BxkdJFkL79Ql3ywzyKldfLuX9jwq1eCgQ1MMdqKUDW4q5g38...

What I'm doing wrong?

Nan Yu · Accepted Answer · 2017-10-20 07:14:05Z

2

You need to use OnAuthorizationCodeReceived notification which could be used to acquire access token for microsoft graph api using ADAL/MSAL . Please refer to this blog for ASP.NET Core 2.0 Azure AD Authentication .

answered Oct 20, 2017 at 7:14

Nan Yu

27.7k9 gold badges75 silver badges157 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Toni Wenzel Over a year ago

Thanks, that helped. Now I've a "real" access token. Your code samples of your GitHub repo also helped me. Especially getting a special access token for Microsoft Graph.

Nan Yu Over a year ago

Please consider accept as answer which may help others who meet same problem .

Collectives™ on Stack Overflow

How do request a correct access token in ASP.NET Core for Azure AD to access Microsoft Graph

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related