Having an issue with Oauth2

Question

Having an issue with Oauth2

Jose David Rojas Aguilar 1

I configured a node-based oauth2 authentication process using this library: passport-oauth2.

It's working when I log in with a professional account but When I try to log in with an email @harsh.com .com, I get a 403 error when I consume https://graph.microsoft.com/v1.0/me with the token I get from the login flow.

Should I use another endpoint for not-corporate domains like @Karima ben .com or @harsh.com .com?

Jose David Rojas Aguilar 1 Reputation point

2022-06-07T22:45:44.69+00:00

This is the error that I get from the endpoint.

{
"error": {
"code": "ErrorInsufficientPermissionsInAccessToken",
"message": "Exception of type 'Microsoft.Fast.Profile.Core.Exception.ProfileAccessDeniedException' was thrown.",
"innerError": {
"date": "2022-06-07T22:44:52",
"request-id": "c613d639-1174-411d-9821-ac3b273dc40e",
"client-request-id": "c613d639-1174-411d-9821-ac3b273dc40e"
}
}
}
Shweta Mathur 30,431 Reputation points Microsoft Employee Moderator

2022-06-14T11:58:25.673+00:00

Hii @Jose David Rojas Aguilar ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,
Shweta

2 answers

Your answer

Jose David Rojas Aguilar 1 Reputation point

2022-06-07T22:45:44.69+00:00

This is the error that I get from the endpoint.

{
"error": {
"code": "ErrorInsufficientPermissionsInAccessToken",
"message": "Exception of type 'Microsoft.Fast.Profile.Core.Exception.ProfileAccessDeniedException' was thrown.",
"innerError": {
"date": "2022-06-07T22:44:52",
"request-id": "c613d639-1174-411d-9821-ac3b273dc40e",
"client-request-id": "c613d639-1174-411d-9821-ac3b273dc40e"
}
}
}
Shweta Mathur 30,431 Reputation points Microsoft Employee Moderator

2022-06-14T11:58:25.673+00:00

Hii @Jose David Rojas Aguilar ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,
Shweta

Answer 1

Vicky Kumar (Mindtree Consulting PVT LTD) 1,161 Microsoft Employee

Thanks for reaching out to us, could you please put your decode access token http://jwt.ms/ and see if the permission is present or not. User.Read permission is sufficient but could you please try by adding scopes User.ReadAll permission.

Maksad Annamuradov 6 Reputation points

2022-06-27T17:44:50.39+00:00

Having similar issue here. The site you posted does not decode access tokens. Only for jwt id_tokens. And the id_token does not show any scope present. I have all the openid permissions checked on GraphApi. Still getting same error about profile exception.
Shweta Mathur 30,431 Reputation points Microsoft Employee Moderator

2022-07-04T14:55:59.48+00:00

Hi @ MaksadAnnamuradov-9986,

https://jwt.ms allow you to decode access tokens. If you are not able to decode access token using jwt.ms, thats means your token is not valid. Please check the request parameters and permissions to get the valid access token.

Thanks,
Shweta

Answer 2

Hi @Jose David Rojas Aguilar ,

Thanks for reaching out.

I understand you are trying to access Graph API endpoint with personal accounts and getting "ErrorInsufficientPermissionsInAccessToken" error.

This could be due to sign-in audience is not correctly configured in "supported account types" while registering the application.

Selecting the "Accounts in any organizational directory and personal Microsoft accounts" option will allow users who have personal Microsoft accounts and users from another tenant to access the application.

You need to call common endpoint to authenticate the user which should allow both Microsoft accounts and work or school accounts to access the application

https://login.microsoftonline.com/common/oauth2/v2.0/token

Also, make sure if you have registered your application initially as single tenant but wants to allow users from another tenant or Microsoft accounts as well. I would recommend to register the new application with above option to target largest sign-in audience to access your application.

Updating the account supported by an application will sometimes not allow to update application from single-tenant to multi-tenant due to Application ID URI (App ID URI) name collisions. So it is better to avoid that and register new application as multi-tenant application.

Hope this will help.

Thanks,
Shweta

-------------------------------------

Please remember to "Accept Answer" if answer helped you.

Maksad Annamuradov 6 Reputation points

2022-06-27T17:50:05.863+00:00

Same issue here. I have registered applications with Supported Account types 3rd option. And calling the common endpoint to get access token. I have checked all the OpenId permissions checked on Graph API. The issue is still persisting. Do you have any other suggestions on why it could be doing this? It was working couple days ago before the weekends, and on Monday, it decided to give that error which is odd

Share via

Having an issue with Oauth2

2 answers

Your answer