access a azure active directory protected web service using Java

Question

Here is the background:

• App Service A, using Tomcat and Springboot, provides web service end points. e.g.https://xxx.azurewebsites.net/appA/order/1111
• webapp A is protected by AAD authentication (express config). An application (web-app) is registered in AAD. The client id for web-app is [client-id].
• A client secret [client-secret] is created in web-app.
• The AAD directory id is [tenant-id].
• Using browser to open the URL above. Showing the AD login page, after entering the credentials, I can get the expected json file.

Now I have another console application which tries to fetch order info from webapp A. The code like this:

String AUTHORITY = "https://login.microsoftonline.com/" + [tenant-id];
String ORDER_URL = "https://xxx.azurewebsites.net/appA/order/1111"

ExecutorService service = Executors.newFixedThreadPool(1);
ClientCredential credentials = new ClientCredential([client-id], [client-secret]);

AuthenticationContext context = new AuthenticationContext(AUTHORITY, false, service);

Future<AuthenticationResult> future = context.acquireToken("https://graph.microsoft.com", credentials, null);
AuthenticationResult result = future.get();

String token = result.getAccessToken();
System.out.println(token);

HttpURLConnection conn = (HttpURLConnection) new URL(ORDER_URL).openConnection();
conn.setDoOutput(true);
conn.setRequestProperty("Content-Type", "application/json; charset=UTF-8");
conn.setRequestMethod("GET");
conn.setRequestProperty("Authorization", "Bearer " + token);
conn.connect();

int responseCode = conn.getResponseCode();
System.out.println(responseCode);

InputStream is = conn.getInputStream();
...

I'm able the get the token, but the responseCode of 401, and the error message is "You do not have permission to view this directory or page".

So do I need to assign other API permission in order to make it work ? Or there're some other settings are missed.

Answer 1

I can reproduce your issue, the resource should be the client-id or the Application ID URI of the app you want to access, not the MS graph https://graph.microsoft.com.