I used the token generated by msal to access the openai api, but was prompted not to have permission

xiaoming chen 0

var msal = require('@azure/msal-node');

; (async () => {

  const msalConfig = {

    auth: {

      clientId: 'cca04989-623d-47c0-80a9-*******',

      authority: "https://login.microsoftonline.com/a830e50c-888b-41fc-9ca0-*******/", 

      clientSecret: 'VV38Q~zESpRrDkvmOslID************'

    },

  }

  const msalInstance = new msal.ConfidentialClientApplication(msalConfig);

  var res = await msalInstance.acquireTokenByClientCredential({ scopes: ['https://cognitiveservices.azure.com/.default'] })

  console.log('res', res)

})()

3181684936635_.pic

3171684936635_.pic

VasimTamboli 4,410 Reputation points

2023-05-24T14:34:46.7566667+00:00

To resolve this issue, you need to ensure that the Azure AD application associated with your client credentials has the appropriate API permissions configured. Here's what you can do:

Open the Azure portal and navigate to the Azure Active Directory (AAD) where your application is registered.

Go to the "App registrations" (or "Enterprise applications") section and locate the application with the Client ID ('cca04989-623d-47c0-80a9-*******') you are using in your code.

Open the application and go to the "API permissions" (or "Permissions" or "API access") section.

Add the required permission for the OpenAI API. In this case, you need to add the permission for the Cognitive Services API. If it's not listed, click on "Add a permission" and search for "Cognitive Services." Select the appropriate permission and click on "Add permissions" to save the changes.

Once the permission is added, you may need to grant admin consent. If you have the necessary permissions, you can grant consent from the same "API permissions" section by clicking on the "Grant admin consent" button.

After adding and granting consent for the required permission, regenerate the client secret for your Azure AD application if needed, and update the 'clientSecret' value in your code with the new secret.

Run your code again to acquire a new token using the updated client credentials.

By ensuring that your Azure AD application has the necessary API permissions and acquiring a new token, you should be able to access the OpenAI API without encountering the permission error.
xiaoming chen 0 Reputation points

2023-05-24T15:09:57.6733333+00:00

First of all, thank you very much, but after doing what you said, it still doesn't seem to be working
Marilee Turscak-MSFT 33,696 Reputation points Microsoft Employee

2023-05-24T20:53:46.1933333+00:00

@VasimTamboli I am not sure if AI was used to source any part of this answer, but just a note that AI usage on Microsoft Q&A strictly requires citation and is prohibited without proper attribution. https://learn.microsoft.com/en-us/answers/support/ai-usage-policy

1 answer

Alfredo Revilla - Senior Freelance SWE, SWA, IAM 26,936 Reputation points

2023-05-24T18:17:17.0666667+00:00

Hello @xiaoming chen , as stated by VasimTamboli, you need to add proper application, not delegated permissions as displayed in your latest comment. This because (in your code) you're authenticating as an application, not a user. For more information take a look to Types of permissions and Authentication.

Let us know if you need additional assistance. If the answer was helpful, please accept it and rate it so that others facing a similar issue can easily find a solution.
Please sign in to rate this answer.
JamesTran-MSFT 36,351 Reputation points Microsoft Employee

2023-05-26T17:18:40.13+00:00

@xiaoming chen

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Alfredo Revilla - Senior Freelance SWE, SWA, IAM 26,936 Reputation points

2023-06-01T05:47:15.84+00:00

Hello @xiaoming chen , does the issue still persist? Do you need help with anything else?
Sign in to comment