Client credentials token retrieved through Client AAD not working on API Azure

Question

I am trying to connect to API through Client AAD details(clientid,client secret) using "client_credentials" grant_type, I am able to fetch the token with API scope but when I use that token to retrieve API results, I am getting 401 unauthorized error.

I am trying to understand what kind of permissions are required on API AAD for Client AAD to accept the token. Please help me to understand this.

Following are the permissions on both AAD :

API AAD:

User.Read - > Delegated - > Sign In and read user profile

Client AAD:

User impersonation - > Delegated - > FOR API AAD

Microsoft Graph - Delegated,Application ->User.Read.All

Thanks,

Deepak.

Are you going to access the "profile" api? docs.microsoft.com/en-us/graph/api/resources/… — Carl Zhao
Please check if you have a valid access token for this API.docs.microsoft.com/en-us/azure/marketplace/… — Carl Zhao
If my answer is helpful for you, you can accept it as answer( click on the check mark beside the answer to toggle it from greyed out to filled in.). See meta.stackexchange.com/questions/5234/… can be beneficial to other community members. Thank you. — Carl Zhao

Carl Zhao Carl Zhao · Accepted Answer · 2020-06-15T11:05:40

If you use Client Credential flow to obtain an access token, you must create an application and grant application permissions to the application (this is because Client Credential flow has no user interaction).

Before that, you need to understand the difference between delegated permissions and application permissions:

Application permissions allow an application in Azure Active Directory to act as it's own entity, rather than on behalf of a specific user.

Delegated permissions allow an application in Azure Active Directory to perform actions on behalf of a particular user.

Then you need to define the application permissions by editing the list of api applications.here is an example.

Refer to this document and use Client Credential flow to get access tokenhere:

1.First you need to get the administrator's consent:

GET https://login.microsoftonline.com/{tenant}/adminconsent?
client_id=6731de76-14a6-49ae-97bc-6eba6914391e
&state=12345
&redirect_uri=http://localhost/myapp/permissions

2.Then you can get the access token by sharing the secret:

POST /{tenant}/oauth2/v2.0/token HTTP/1.1           //Line breaks for clarity
Host: login.microsoftonline.com
Content-Type: application/x-www-form-urlencoded

client_id=535fb089-9ff3-47b6-9bfb-4f1264799865
&scope=https%3A%2F%2Fgraph.microsoft.com%2F.default
&client_secret=qWgdYAmab0YSkuL1qKv5bPX
&grant_type=client_credentials

Parse the token and you will see your custom roles:

Okay, now you can use the token to access your resources.

Client credentials token retrieved through Client AAD not working on API Azure

1 Answers