Unable to get ADO user_impersonation scope access token using Azure Bot's OauthConnection to AAD

Santhosh Lakkanpalli 0 Microsoft Employee

Hi,

I am trying to develop a Teams Message Extensions app which can unfurl Azure Devops (ADO) urls in to Adaptive Cards (AC). For this, referred this doc Add authentication to your Teams bot .

For this, I have a bot registered and setup the OauthConnection to connect to an AAD app. This AAD app has the permissions to ADO user_impersonation api.

I have added relevant screenshots which depict the same.

I added Azure Dev ops user_impersonation permissions in API Permissions pane of AAD registration. Added an Oauth connection in the bot service pointing to this AAD registration.

But when I test the connection using Test Connection , it always fails to generate the access token.

Instead of looking for that scope in ADO's registration, it always looks for that scope in Microsoft Graph app.

Following is the error:

{
  "error": {
    "code": "ServiceError",
    "message": "Missing required query string parameter: code. Url = https://token.botframework.com/.auth/web/redirect?error=invalid_client&error_description=AADSTS650053%3a+The+application+%27bot-teams-authentication-aad%27+asked+for+scope+%27user_impersonation%27+that+doesn%27t+exist+on+the+resource+%2700000003-0000-0000-c000-000000000000%27.+Contact+the+app+vendor.%0d%0aTrace+ID%3a+7cae0886-06d9-4685-a21b-03d28a080200%0d%0aCorrelation+ID%3a+974d834f-1216-48bd-b72a-f278cb284da7%0d%0aTimestamp%3a+2023-08-29+09%3a31%3a03Z&state=518c5d86f0574d48a8df99e9c02d02f4"
  }
}

Error excerpt below from above full error log:

The+application+%27bot-teams-authentication-aad%27+asked+for+scope+%27user_impersonation%27+that+doesn%27t+exist+on+the+resource+%2700000003-0000-0000-c000-000000000000%27.

It should be looking for user_impersonation scope in ADO app (499b84ac-1321-427f-aa17-267ca6975798) but it is looking in MS Graph app (00000003-0000-0000-c000-000000000000).

Following is my test AAD app registration manifest info requiredResourceAccess content:

	"requiredResourceAccess": [
		{
			"resourceAppId": "499b84ac-1321-427f-aa17-267ca6975798",
			"resourceAccess": [
				{
					"id": "ee69721e-6c3a-468f-a9ec-302d16a4c599",
					"type": "Scope"
				}
			]
		}
	],

Following are the images of the setup:

Screenshot 2023-08-30 at 2.11.44 PM

Screenshot 2023-08-29 at 3.01.22 PM

Can you please help why it is not working?

What can be done to get access token with ADO app audience and scope user_impersonation?

Sayali-MSFT 2,341 Reputation points Microsoft Vendor

2023-08-31T05:47:01.3533333+00:00

@Santhosh Lakkanpalli-Thanks for reporting your issue.

Getting related thread, are you trying the same?
https://stackoverflow.com/questions/62841846/how-to-handle-user-cancel-for-oauth2-request-in-teams-messaging-extension
Sayali-MSFT 2,341 Reputation points Microsoft Vendor

2023-08-31T12:00:00.75+00:00
The error message "Missing required query string parameter: code" typically indicates that you are trying to perform an operation that requires an authorization code, but you haven't included the "code" query parameter in your request. This parameter is essential when exchanging an authorization code for an access token.

To obtain an access token, you need to make a POST request to the token endpoint (typically using OAuth 2.0). In this request, include the "code" parameter as a form parameter, like this:

cssCopy code POST https://login.microsoftonline.com/{tenant_id}/oauth2/token Content-Type: application/x-www-form-urlencoded grant_type=authorization_code &client_id={client_id} &client_secret={client_secret} &redirect_uri={redirect_uri} &code={your-authorization-code}

Ensure that you replace {client_id}, {client_secret}, {redirect_uri}, and {your-authorization-code} with the actual values.
Santhosh Lakkanpalli 0 Reputation points Microsoft Employee

2023-09-04T01:47:49.67+00:00

I am using Azure AD v2 as token service provider which you can confirm from the screenshot. This is not an issue with auth-code but the scope is missing.

If I try by setting up above Oauth connection with MS Graph api scope (such as User.Read), it works correctly.

But only if I add the user_impersonation scope, it fails.

So I believe the call is failing at authorize step itself not authenticate step. In your reply, you mentioned the url which is for authenticate, to get the token using the code received in the authorize request. I am saying that the authorize request itself is failing because of the scope not being looking in the right app.
Sayali-MSFT 2,341 Reputation points Microsoft Vendor

2023-09-27T12:33:30.4733333+00:00

The 'user_impersonation' scope is a delegated permission type that allows an application to impersonate the user in the Azure portal. This means the application can perform actions on behalf of the user, such as reading or writing data.

Could you please check with the below scenario:-

The application registration in Azure AD might not have the necessary permissions set up. You need to ensure that the 'user_impersonation' permission is added to your app registration in the Azure portal.

The user might not have consented to the application performing actions on their behalf. When using delegated permissions, the user is prompted to give consent the first time they use the app. If they haven't given consent, the authorization request will fail.

The 'user_impersonation' scope might not be correctly formatted in your authorization request. The scope should be in the format 'api:///user_impersonation'.

Share via

Unable to get ADO user_impersonation scope access token using Azure Bot's OauthConnection to AAD

Your answer