EWS Connection Giving Unauthorized (401) Error

Question

I have been working on a program that scans an exchange inbox for specific emails from a specified address. Currently the program reads the inbox, downloads the attachment, and moves the email to another folder. However, after about 15 pulls from the EWS server, the connection starts giving a 401 Unauthorized error until I restart the program. The program is setup to login via OAuth as basic auth is disabled by the system administrator. Below is the code that I am using to obtain the exchange connection and read the emails from the inbox.

Exchange Connection Code:

public static async Task<ExchangeService> GetExchangeConnection()
    {
        var pcaOptions = new PublicClientApplicationOptions
        {
            ClientId = AppID,
            TenantId = TenantID,
        };

        var pca = PublicClientApplicationBuilder.CreateWithApplicationOptions(pcaOptions).Build();

        var ewsScopes = new string[] { "https://outlook.office365.com/EWS.AccessAsUser.All" };

        var securePassword = new SecureString();
        foreach (char c in Pasword)
            securePassword.AppendChar(c);

        try
        {
            var authResult = await pca.AcquireTokenByUsernamePassword(ewsScopes, Username, securePassword).ExecuteAsync();

            ExchangeService exchangeService = new ExchangeService()
            {
                Credentials = new OAuthCredentials(authResult.AccessToken),
                Url = new Uri("https://outlook.office365.com/ews/exchange.asmx"),
            };

            return exchangeService;
        }
        catch
        {
            return null;
        }
    }

Email Retriever

public static List<Email> RetreiveEmails()
    {
        ExchangeService exchangeConnection = GetExchangeConnection().Result;

        try
        {
            List<Email> Emails = new List<Email>();
            TimeSpan ts = new TimeSpan(0, -5, 0, 0);
            DateTime date = DateTime.Now.Add(ts);
            SearchFilter.IsGreaterThanOrEqualTo EmailTimeFilter = new SearchFilter.IsGreaterThanOrEqualTo(ItemSchema.DateTimeReceived, date);

            if (exchangeConnection != null)
            {
                FindItemsResults<Item> findResults = exchangeConnection.FindItems(WellKnownFolderName.Inbox, EmailTimeFilter, new ItemView(10));

                foreach (Item item in findResults)
                {
                    if (item.Subject != null)
                    {
                        EmailMessage message = EmailMessage.Bind(exchangeConnection, item.Id);
                        message.Load(new PropertySet(BasePropertySet.FirstClassProperties, ItemSchema.TextBody));
                        Emails.Add(new Email(message.DateTimeReceived, message.From.Name.ToString(), message.Subject, message.TextBody.ToString(), (message.HasAttachments) ? "Yes" : "No", message.Id.ToString()));
                    }
                }
            }

            exchangeConnection = null;
            return Emails;
        }
        catch (Exception e)
        {
            Console.WriteLine(e.ToString());
            return null;
        }
    }

The error occurs when the email retriever tries to either create the exchange connection or when requesting the emails from the folder. In either case the code will error out and give me 401 unauthorized while using credentials that work for the first dozen times and then fails after so many attempts. I have tried it with multiple different accounts and the issue persists with all of them and I have made sure that the application is authorized to access the exchange inbox. Any suggestions or help is much appreciated.

Answer 1

After doing further tracing regarding the 401 error it resulted in an issue with the token reaching the end of it's 1 hour lifespan. This is due to the original OAuth token having an initial life of 1 hour. This however was able to be fixed by setting up code to automatically refresh the token when needed. Here is the code to address this issue for anyone else who comes across this problem.

Authentication Manager:

class AuthenticationManager
{ 
    protected IPublicClientApplication App { get; set; }

    public AuthenticationManager(IPublicClientApplication app)
    {
        App = app;
    }

    public async Task<AuthenticationResult> AcquireATokenFromCacheOrUsernamePasswordAsync(IEnumerable<String> scopes, string username, SecureString password)
    {
        AuthenticationResult result = null;
        var accounts = await App.GetAccountsAsync();

        if (accounts.Any())
        {
            try
            {
                result = await (App as PublicClientApplication).AcquireTokenSilent(scopes, accounts.FirstOrDefault()).ExecuteAsync();
            }
            catch (MsalUiRequiredException)
            { }
        }

        if (result == null)
        {
            result = await (App as PublicClientApplication).AcquireTokenByUsernamePassword(scopes, username, password).ExecuteAsync();
        }

        return result;
    }
}

I am using direct username and password authentication but the line of code can be switched to getting the user authentication via interactive methods as well. The code essentially creates a new instance of the authentication manager with a PublicClientApplication used to initialize it which houses the appID and tenantID. After initializing, you can call the AquireATokenFromCacheOrUsernamePasswordAsync which will attempt to see if there is an account present to get a token against. Next it will attempt to retrieve the previously cached token or refresh the token if it expires in less than 5 minutes. If there is a token available it will return that to the main application. If there isn't a token available, it will acquire a new token using the username and password supplied. Implementation of this code looks something like this,

class ExchangeServices
{
     AuthenticationManager Manager = null;

     public ExchangeServices(String AppId, String TenantID)
     {
          var pcaOptions = new PublicClientApplicationOptions
          {
               ClientId = AppID,
               TenantId = TenantID,
          };
          var pca = PublicClientApplicationBuilder.CreateWithApplicationOptions(pcaOptions).Build();
          Manager = new AuthenticationManager(pca);
     }

     public static async Task<ExchangeService> GetExchangeService()
     {
          var ewsScopes = new string[] { "https://outlook.office365.com/EWS.AccessAsUser.All" }
          var securePassword = new SecureString();
          foreach(char c in Password)
               securePassword.AppendChar(c);

          var authResult = await Manager.AquireATokenFromCacheOrUsernamePasswordAsync(ewsScopes,           Username, securePassword);

          ExchangeService exchangeService = new ExchangeService()
          {
               Credentials = new OAuthCredentials(authResult.AccessToken),
               Url = new Uri("https://outlook.office365.com/ews/exchange.asmx");
          };
          return exchangeService;
     }
}

The code above is everything laid out that is needed to create a new authentication manager and use it to get and update new tokens while using EWS services through OAuth. This is the solution that I found to fix the issue described above.