401 Unauthorized after creating client context using Access Token

Prateek Srivastava 1

Hi,

I have a web application deployed to Azure and registered as App Registration with AAD authentication configured.

I am getting current users info as "ClaimsPrincipal.Current" and access token as Request.Headers["x-ms-id-aad-token"].

However when try to send the above access token to authorization header in client context and try to get current user, it throws 401 unauthorized

MichaelHan-MSFT 18,031 Reputation points

2021-07-13T06:27:04.627+00:00

,

How did you get the acess token for the AAD app? Please share more details about your code to track down this issue.
Prateek Srivastava 1 Reputation point

2021-07-14T06:22:24.16+00:00

Hey Micheal,

My application is deployed as an Azure app service and secured by AAD authentication using EasyAuth.

I am able to get the access token in Page_Load event with Request.Headers["x-ms-token-aad-access-token"] function.

I am getting a token something like

"eyJ0eXAiOiJKV1QiLCJub25jZSI6IkJvLWw4NzNvUFJISXpL............................."

However when I try to create client object by passing the above access token in Authorization header and call ExecuteQuery(), it returns 401 unauthorized.
MichaelHan-MSFT 18,031 Reputation points

2021-07-14T06:35:02.103+00:00

Hi @Prateek Srivastava ,
You could try to use https://jwt.ms to decode the access token to check more.
Prateek Srivastava 1 Reputation point

2021-07-14T07:24:19.26+00:00

I did that and this is what I got
MichaelHan-MSFT 18,031 Reputation points

2021-07-15T02:28:10.51+00:00

What's the value of 'aud' in the result? Is it "00000003-0000-0000-c000-000000000000"?

If so, it means that the access token can only access Microsoft Graph resource. You cannot access SharePoint with this token.
Prateek Srivastava 1 Reputation point

2021-07-15T04:01:06.01+00:00

No, 'aud' has a different value. Infact 'the value of 'aud' is equal to 'Client ID' of my Azure App Registration.

"provider_name": "aad",
"user_claims": [
{
"typ": "aud",
"val": "65bc2110-3d22-45d2-8175-840aedc1e7a0"
},
{
"typ": "iss",
"val": "https://login.microsoftonline.com/54f1c50c-e960-4359-94fa-e790e17dcfb4/v2.0"
},
{
"typ": "iat",
"val": "1626321145"
},
{
"typ": "nbf",
"val": "1626321145"
},
{
"typ": "exp",
"val": "1626325045"
},
{
"typ": "acct",
"val": "0"
},
Prateek Srivastava 1 Reputation point

2021-07-16T07:20:29.99+00:00

Hey @MichaelHan-MSFT ,

Any suggestions?

Is it possible to setup a call and check this out.

Should be a quick call approx. 15-20 mins
Prateek Srivastava 1 Reputation point

2021-07-17T07:16:57.133+00:00

@MichaelHan-MSFT Any update??
Prateek Srivastava 1 Reputation point

2021-07-17T12:14:15.263+00:00

Any update?

Share via

401 Unauthorized after creating client context using Access Token

Your answer