Hi all, I'm making a Teams tab app and I followed this page about getting Teams User Access Tokens for one of the app's features. However, I would like to do it silently without the need of logging in. The only way I could find to get such a token is with the 'getTokenForTeamsUser' method from the @azure/communication-identity library (I'm using js). The method requires an Aad access token, an Entra access token in other words. I already tried getting an access token from: The On-behalf-of flow: this token is invalid according to getTokenForTeamsUser. Raw error text: errorMsgWithOBOToken.txt Microsoft Graph: this token can be generated from the same authcode that you use in the tutorial for the entra token, but is also not valid. Raw error text: errorMsgWithGraphToken.txt All approaches have used the same scopes, and as such I don't really understand what else I could be missing. I haven't tried the MSAL token cache yet, but this still requires an initial ms login, which is not desirable if you're already in teams. Or is it possible to fetch the user account object from the Teams app libraries? What other way is there? I'd love to hear your experiences.

Other ways to get a Teams User Access Token?

Jeroen H 40

Hi all, I'm making a Teams tab app and I followed this page about getting Teams User Access Tokens for one of the app's features. However, I would like to do it silently without the need of logging in. The only way I could find to get such a token is with the 'getTokenForTeamsUser' method from the @azure/communication-identity library (I'm using js). The method requires an Aad access token, an Entra access token in other words. I already tried getting an access token from:

The On-behalf-of flow: this token is invalid according to getTokenForTeamsUser. Raw error text: errorMsgWithOBOToken.txt
Microsoft Graph: this token can be generated from the same authcode that you use in the tutorial for the entra token, but is also not valid. Raw error text: errorMsgWithGraphToken.txt

All approaches have used the same scopes, and as such I don't really understand what else I could be missing. I haven't tried the MSAL token cache yet, but this still requires an initial ms login, which is not desirable if you're already in teams. Or is it possible to fetch the user account object from the Teams app libraries? What other way is there? I'd love to hear your experiences.

Alfredo Revilla (Personal Account) 391 Reputation points

2024-02-29T04:03:16.46+00:00

Please share error details, better if in raw text.
Ran Hou-MSFT 7,440 Reputation points Microsoft Vendor

2024-02-29T05:21:05.7333333+00:00

Thanks for visiting our forum. Microsoft Teams tag is mainly focused on the general issue of Microsoft Teams application troubleshooting. Based on your description, this problem is related to Teams development, which we do not support. So we will add Teams development tag to your thread. Thank you for your understanding and patience.
Jeroen H 40 Reputation points

2024-02-29T08:40:13.9866667+00:00

Hi @Alfredo Revilla (Personal Account) , I added the error message received when trying to use a MS Graph access token for the getTokenForTeamsUser method. I think I removed any sensitive information. Hope it clears things up!

Prasad-MSFT 5,621 Microsoft Vendor

By implementing the OBO flow correctly, you should be able to silently acquire an access token for Microsoft Graph in your Teams tab app without the need for the user to log in again.

Get the Token ID from Teams Client You can use the microsoftTeams.authentication.getAuthToken() method to get the token ID from the Teams client. This token will be used in the OBO flow to exchange it for a server-side token.

microsoftTeams.authentication.getAuthToken().then((result) => {
    // result contains the id token
    console.log(result);
})

Exchange the Token ID with the Server-Side Token You need to implement the OBO flow to fetch the access token from the Teams client using MSAL.

// Exchange client-side token with server token
app.post('/getProfileOnBehalfOf', function(req, res) {
    var tid = "<Tenant id>";
    var token = "<Client side token>";
    var scopes = ["https://graph.microsoft.com/User.Read"];

    // Creating MSAL client
    const msalClient = new msal.ConfidentialClientApplication({
        auth: {
            clientId: "<Client ID>",
            clientSecret: "<Client Secret>"
        }
    });

    var oboPromise = new Promise((resolve, reject) => {
        msalClient.acquireTokenOnBehalfOf({
            authority: `https://login.microsoftonline.com/${tid}`,
            oboAssertion: token,
            scopes: scopes,
            skipCache: true
        }).then(result => {
            console.log("Token is: " + result.accessToken);
        }).catch(error => {
            reject({ "error": error.errorCode });
        });
    });
});

Jeroen H 40 Reputation points

2024-02-29T10:05:59.4033333+00:00

Hi @Prasad-MSFT ,
I was already able to implement OBO correctly to get a MS Graph token, as I mentioned in my post. I even used the exact code you mentioned.
The problem arises when I try to use said token as part of the 'options' parameter in this specific method.
This gives an InvalidAccessToken error, I've added the full raw error text to my original post.
Prasad-MSFT 5,621 Reputation points Microsoft Vendor

2024-03-05T09:54:04.22+00:00

"InvalidAccessToken" error occurs due to various reasons such as token expiration, incorrect token format, or insufficient permissions associated with the token.

Before using the access token with the CommunicationIdentityClient.GetTokenForTeamsUser method, ensure that the token is valid and has not expired. You can validate the token using the Microsoft Authentication Library (MSAL) for .NET. Also, verify that the access token obtained through the OBO flow includes the necessary scopes and permissions required by the CommunicationIdentityClient.GetTokenForTeamsUser method.

Ref: https://learn.microsoft.com/en-us/dotnet/api/overview/azure/communication.identity-readme?view=azure-dotnet
Jeroen H 40 Reputation points

2024-03-05T14:37:30.0266667+00:00

Hi @Prasad-MSFT ,

The errors I posted were from tokens used directly after acquiring them, so they were definitely not expired. Furthermore, they all used the same scopes.

I'm not sure what function you refer to for 'validating' the token in the MSAL library.

No documentation I can find about the signature of the GetTokenForTeamsUser method gives any information about the needed permissions nor scopes for the entra token to be accepted, and neither am I able to find that information in the page you linked.

If you are aware of these permissions and/or scopes, could you specify them please?
Prasad-MSFT 5,621 Reputation points Microsoft Vendor

2024-03-07T09:10:30.4966667+00:00

To validate the token in the MSAL library, you can use third-party libraries such as jsonwebtoken.

https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/samples/msal-node-samples/on-behalf-of/web-api/index.js