use java sdk call graph api with AADSTS7000218 error

Question

Context: I have a Azure App like below

Because this app is assigned to delegated permission, so I use UsernamePasswordCrendential as auth provider. Code:

public void getClient() throws Exception {
        final InetSocketAddress proxyAddress = new InetSocketAddress(proxyHost,
                proxyPort);
// Setup proxy for the token credential from azure-identity
// From the com.azure.core.http.* packages
        final ProxyOptions options = new ProxyOptions(ProxyOptions.Type.HTTP, proxyAddress);
// If the proxy requires authentication, use setCredentials
        options.setCredentials(proxyUsername, proxyPassword);
        final HttpClient authClient = new NettyAsyncHttpClientBuilder()
                .proxy(options)
                .build();
        final UsernamePasswordCredential credential = new UsernamePasswordCredentialBuilder()
                .clientId(clientId)
                .tenantId(tenantId)
                .httpClient(authClient)
                .username(mailboxUsername)
                .password(mailboxPassword)
                .build();
// scopes is a list of permission scope strings
        final TokenCredentialAuthProvider authProvider = new TokenCredentialAuthProvider(
                scopes, credential);
// Setup proxy for the Graph client
        final Proxy proxy = new Proxy(Proxy.Type.HTTP, proxyAddress);
// This object is only needed if the proxy requires authentication
        final Authenticator proxyAuthenticator = (route, response) -> {
            String credential1 = Credentials.basic(proxyUsername, proxyPassword);
            return response.request().newBuilder()
                    .header("Proxy-Authorization", credential1).build();
        };
// Omit proxyAuthenticator if no authentication required
        final OkHttpClient httpClient = HttpClients.createDefault(authProvider)
                .newBuilder()
                .proxy(proxy).proxyAuthenticator(proxyAuthenticator)
                .build();
        final GraphServiceClient<Request> graphClient = GraphServiceClient.builder()
                .httpClient(httpClient).buildClient();
        graphClient.users(mailboxUsername).messages().buildRequest().get();
    }

Result:

com.microsoft.aad.msal4j.MsalServiceException: AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'. Trace ID: ae0dcaa5-0c09-4dc9-860d-69f6a18d2c00 Correlation ID: 32a9b65e-d4a3-4a2b-8c7b-74b071f43048 Timestamp: 2024-02-20 08:17:24Z 
at com.microsoft.aad.msal4j.MsalServiceExceptionFactory.fromHttpResponse(MsalServiceExceptionFactory.java:45) ~[msal4j-1.14.0.jar:1.14.0]
at com.microsoft.aad.msal4j.TokenRequestExecutor.createAuthenticationResultFromOauthHttpResponse(TokenRequestExecutor.java:111) ~[msal4j-1.14.0.jar:1.14.0]
at com.microsoft.aad.msal4j.TokenRequestExecutor.executeTokenRequest(TokenRequestExecutor.java:34) ~[msal4j-1.14.0.jar:1.14.0]
at com.microsoft.aad.msal4j.AbstractClientApplicationBase.acquireTokenCommon(AbstractClientApplicationBase.java:129) ~[msal4j-1.14.0.jar:1.14.0]
at com.microsoft.aad.msal4j.AcquireTokenByAuthorizationGrantSupplier.execute(AcquireTokenByAuthorizationGrantSupplier.java:63) ~[msal4j-1.14.0.jar:1.14.0]
at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:69) [msal4j-1.14.0.jar:1.14.0]
at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:18) [msal4j-1.14.0.jar:1.14.0]
at java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1604) [na:1.8.0_281]
at java.util.concurrent.CompletableFuture$AsyncSupply.exec(CompletableFuture.java:1596) [na:1.8.0_281]
at java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:289) [na:1.8.0_281]
at java.util.concurrent.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1067) [na:1.8.0_281]
at java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1703) [na:1.8.0_281]
at java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:172) [na:1.8.0_281]
2024-02-20 16:17:24.385 ERROR 23924 --- [nPool-worker-25] c.a.identity.UsernamePasswordCredential  : Azure Identity => ERROR in getToken() call for scopes [https://graph.microsoft.com/.default]: Failed to acquire token with username and password. To mitigate this issue, please refer to the troubleshooting guidelines here at [https://aka.ms/azsdk/java/identity/usernamepasswordcredential/troubleshoot]()

If I want to add client_secret to request body, where I can add client_secret to UsernamePasswordCrendential, Or there is any other way to access graph api? many thanks for you help!

Answer 1

Hi @Huimin ZHANG

You just need to enable public client flow for this app.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.