Unable to retrieve OAuth access token using Azure Key vault scope with Client credentials grant type

Pavani Muddana 1

I am trying to use Azure Key vault scope in my Oauth 2.0 request to retrieve the access token using Client credentials grant type from another cloud provider.(IBM Cloud)

From IBM cloud the request is been received to Azure Oauth endpoint in the below format

client_id=<clientID>&scope=https%3A%2F%2Fvault.azure.net%2F.default&client_secret=<Secret>&grant_type=client_credentials

Below is the request format I am trying to use while calling Azure OAuth endpoint
Endpoint: https://login.microsoftonline.com/<tenant>/oauth2/v2.0/token
Headers:
Content-Type:application/x-www-form-urlencoded
Body:
client_id=<clientID>
&scope=https%3A%2F%2Fvault.azure.net%2F.default
&client_secret=<clientSecret>
&grant_type=client_credentials

I am receiving continuously This error 404 Not found with empty response body.

JamesTran-MSFT 36,361 Reputation points Microsoft Employee

2020-10-02T00:08:04.55+00:00

@Pavani Muddana
I just wanted to check in and see if you required additional assistance or if you were able to resolve this issue?

----------

If any reply/answer helped resolve your question, please remember to "mark as answer" so that others in the community facing similar issues can easily find the solution.

2 answers

soumi-MSFT 11,716 Reputation points Microsoft Employee

2020-09-21T13:11:08.703+00:00

@Pavani Muddana , Thank you for reaching out. I tried accessing the v2/token endpoint of the AAD to fetch an access-token and was able to successfully fetch the token from AAD.

Hope this helps.

Do let us know if this helps and if there are any more queries around this, please do let us know so that we can help you further. Also, please do not forget to accept the response as Answer; if the above response helped in answering your query.
Please sign in to rate this answer.

2 people found this answer helpful.
Pavani Muddana 1 Reputation point

2020-09-22T07:06:06.81+00:00

Hi @soumi-MSFT

Thanks for responding.

Even i was able to get the Token when i try from postman to direct Oauth endpoint. The problem here is when i am trying to connect from IBM cloud APIConnect to Azure Cloud Oauth endpoint I am not able to retrieve the access token . I could see from my API logs that, It is reaching till Azure.

So i would request if there is anyway to check the logs of this Oauth endpoint and see what is happening when i try to hit the request from my end.

Please suggest.

soumi-MSFT 11,716 Reputation points Microsoft Employee

2020-09-22T08:32:11.343+00:00

Hello @Pavani Muddana , Thank you for sharing the details. If things are breaking with the IBM Cloud APIConnect Application, then would would need to understand what kind of request is being sent by this application to AAD, that AAD is rejecting that request. It would be great if you can collect a fiddler trace and capture the entire scene where the application reaches AAD with the request and then AAD errors out so that we can analyze the same. The fiddler trace would also provide us a correlation ID and timeStamp, using that we can also try to look into our backend logs of AAD to understand in more detail if required.

For installing fiddler, you can find the .exe file here: https://www.telerik.com/download/fiddler
To capture HTTPS traffic you need to configure Fiddler to capture decrypted HTTPS traffic. To configure that you can find the details here: https://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/DecryptHTTPS

Pavani Muddana 1 Reputation point

2020-09-22T10:01:39.577+00:00

Hi @soumi-MSFT

I am not sure if i have captured it correctly. But i tried to manage to capture the screen shot.

Let me know if this helps. If not please provide me steps to capture the trace.. So that i could get ehat you are expecting.

Thank you :)

soumi-MSFT 11,716 Reputation points Microsoft Employee

2020-09-22T11:07:47.833+00:00

@Pavani Muddana , The image of the fiddler trace won't help. We need the fiddler capture file (.saz file) to look into this deeper.
In case you face difficulties in capturing the trace, do drop us an email on azcommunity[at]microsoft[dot]com with the following details:

TenantID:

Azure Subscription ID:

This Forum Post URL:

Do share the email with us and we will connect with you offline over the email.

Pavani Muddana 1 Reputation point

2020-09-22T11:30:59.087+00:00

@soumi-MSFT I managed to take the export of it. But it contains more secure data. So I have password protected SAZ file.

Please let me know if we can send it to the above mentioned email ID.

soumi-MSFT 11,716 Reputation points Microsoft Employee

2020-09-22T11:36:26.727+00:00

@Pavani Muddana , Yes, that fiddler would contain some sensitive information and hence please do send an email on azcommunity[at]microsoft[dot]com with the following details as mentioned in the above response.

TenantID:

Azure Subscription ID:

This Forum Post URL:

Do attach the file to the email and send it to us. I will connect you offline with you over that same email thread.

Pavani Muddana 1 Reputation point

2020-09-23T09:58:01.313+00:00

@soumi-MSFT I have dropped an email just now. Sorry for the delay. I was not aware of
Azure Subscription ID.

Pavani Muddana 1 Reputation point

2020-11-05T07:30:33.77+00:00

Hi @soumi-MSFT , I checked with the API connect ops team. It looks like issue is with Azure end. Please see the below comments from API ops team.

We were able to recreate your response from Azure endpoint. Looks like even if we connect to Azure, they respond back with 404 for a valid:

soumi-MSFT 11,716 Reputation points Microsoft Employee

2020-11-05T07:54:30.37+00:00

Hello @Pavani Muddana , if the team says it's an issue on Azure's end, then it would be great if they can share the error that Azure is throwing for the request you sent to Azure. Without a proper error or knowing what Azure is throwing as an error it would be difficult for us to troubleshoot this.

Do let us know the complete error message (along with the CorrelationId and Timestamp), that Azure is throwing while you send a request to Azure, so that based on that we can share our guidance further.
Sign in to comment
Pavani Muddana 1 Reputation point

2020-09-21T12:38:58.843+00:00

@Arvind Kumar Madhukar S. Iyer @Rahul P @Fenhoff, Andrew
Please sign in to rate this answer.

0 comments No comments
Sign in to comment