Skype For Business Online Authentication Error - 403 Permission Denied

Question

Hello Microsoft/Azure/Skype experts,

I'm tasked with accessing presence data from Skype For Business Online accounts from my macOS app (native). I'm unfortunately stuck and i always get a 403 error when i access the autodiscover request and never get the link to the applications resource

I have been following this documentation https://docs.microsoft.com/en-us/skype-sdk/ucwa/authenticationusingazuread

STEP 1 We have registered the app in the Azure Management Portal using our Office 365 account credentials.

We have used custome redirect URL (http://localhost)
Allow Implicit Flow is set to true in manifest
We pre-configure the permissions needed for Skype for business online

STEP 2 Issuing a GET as specified in the documentation to initiate sign in and authorization check.

GET https://login.microsoftonline.com/common/oauth2/authorize?response_type=token&client_id=c#####-4d41-485e-871f-0a22aa79e52b&redirect_uri=http://localhost

This returns a 200 OK.

STEP 3 We got the Auto discover URL as described in the documentation. This is what i get - i use the domain marked in RED.

STEP 4 As per the documentation, they ask me to do this

Requesting an access token using implicit grant flow So i issue a GET as described

https://login.microsoftonline.com/oauth2/authorize? response_type=id_token &client_id=######-4d41-485e-871f-0a22aa79e52b &redirect_uri=http://localhost &state=8f0f4eff-360f-4c50-acf0-99cf8174a58b &resource=https://webdirin1.online.lync.com

Now this shows the sign in page, i sign in and then it throws an error

AADSTS90014%3a+The+required+field+%27nonce%27+is+missing.

I researched and could not fix this error. So after lots of research and looking at this Microsoft documentation LINK (https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#requesting-individual-user-consent) , apparently there is another way of getting the bearer token.

STEP 4 - SECOND TRY

I then Request individual user consent by sending the SCOPE parameter for Skype for Business. I then issue a GET request to

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=#######-4d41-485e-871f-0a22aa79e52b&response_type=code&redirect_uri=http://localhost&response_mode=query&scope=https://api.skypeforbusiness.com/User.ReadWrite&state=12345

This returns an access code which i use in next step to get the TOKEN

STEP 5 - Get the bearer TOKEN

Issue a POST to following URL https://login.microsoftonline.com/common/oauth2/v2.0/token With the following data in POST body

"grant_type": "authorization_code", "client_id": "######-4d41-485e-871f-0a22aa79e52b", "scope": "https://api.skypeforbusiness.com/User.ReadWrite", "code": "OAQABAAIAAACEfexX.........", "redirect_uri": "https://localhost"

This returns the bearer token in the following response JSON

{
"access_token" = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1........w4b--    gnWG_iOGtQ";
"expires_in" = 3599;
"ext_expires_in" = 3599;
scope = "https://api.skypeforbusiness.com/User.ReadWrite";
"token_type" = Bearer;
}

STEP 6

Yay! Got the bearer token at laaast! Now back to the main documentation https://docs.microsoft.com/en-us/skype-sdk/ucwa/authenticationusingazuread

And where we do this - 'Resending an autodiscovery request with the bearer token' We execute a GET request to

https://webdirin1.online.lync.com/Autodiscover/AutodiscoverService.svc/root/oauth/user

Now this, as per the documentation should return this JSON

{
            "_links":{
            "self": 
     {"href":"https://webdirX.online.lync.com/Autodiscover/AutodiscoverService.svc/root/user"},
         "applications": 
        {"href":"https://webpoolXY.infra.lync.com/ucwa/oauth/v1/applications"}
         }
         }

BUT i GET A 403: PERMISSIONS denied error

<div class="content-container"><fieldset>
 <h2>403 - Forbidden: Access is denied.</h2>
 <h3>You do not have permission to view this directory or page 
  using the credentials that you supplied.</h3>
</fieldset></div>

So thus i have never got the applications url and I have checked the manifest, registration and i have no idea, why i get this error.

Any inputs would be appreciated.

For step 4, you need to specify nonce=somestring in the URL. Typically this should be a securely random value that is only used once. It can contain any value. — juunas
@junnas has a good suggestion.. additionally, I see that after Step 4 you have switched to using v2.0 endpoint to get token. Don't mix up the endpoints, and continue using the same one as documentation suggested as it's related to how you registered your application in first place. — Rohit Saigal
@juunas Thanks that helped solve the error - but i get an id_token as a response and dont get the access_token and if use that i still get 403 error — KamyFC
You are only requesting an id token. Set response_type=id_token+token. — juunas
@juunas Thank you. That solved it, am able to get the application URL. It's incredible that MS documentation does not mention the options you told me. But now i need to POST to the applications URL and i get a "502 - Web server received an invalid response while acting as a gateway or proxy server." Do i need to send the same access token? I will keep trying. You have been very helpful. Thank you. — KamyFC

juunas juunas · Accepted Answer · 2019-03-26T06:11:54

For step 4, you need to specify nonce=somestring in the URL. Typically this should be a securely random value that is only used once. It can contain any value.

Also, you are only requesting an id token. Set response_type=id_token+token.

Skype For Business Online Authentication Error - 403 Permission Denied

1 Answers