Which authentication provider to use when in a java app running behind azure app service easy auth?

[bryanidsts]

I'm trying to call GraphServiceClient from a java web app in an azure app service using easy auth. I can call https://graph.microsoft.com/oidc/userinfo with Bearer [x-ms-token-aad-access-token] and it works fine. I've tried DefaultAzureCredential, OnBehalfOfCredential, and AuthorizationCodeCredention, all just throw the error "Error executing the request". Can someone point me in the right direction? @g2vinay @billwert @alzimmermsft @vhvb1989 @baywet

[baywet]

Did you come across this documentation article?

[vhvb1989]

I am curious about this: String tenantId = System.getenv("WEBSITE_AUTH_OPENID_ISSUER").split("/", 5)[3];
Where are you getting this value from?
Is it the tenantId for the app-registration? It usually doesn't need a split() on it

[bryanidsts]

That header has "https://sts.windows.net/TENANTID/v2.0" so that just gives me the tenantid of the app registration out of it yeah
I do believe I found what I was missing
https://gist.github.com/cgillum/bc465bc86274e07cec61299746b99a42
Azure/azure-sdk-for-js#22937 (comment)

[bryanidsts]

Yeah that didn't help, trying the code examples from those links just returns AADSTS50013: Assertion failed signature validation. [Reason - Key was found, but use of the key to verify the signature failed. I have to figure out how GraphServiceClient actually calls https://graph.microsoft.com/v1.0/me and how to inject my existing token as the bearer.

[bryanidsts]

@baywet looks like you asked for exactly this before :)

[bryanidsts]

@baywet ok I think I'm just going to try to implement my own authorizationprovider so I can inject the x-ms-token-aad-access-token directly into the library...

[billwert]

Hey @bryanidsts, can you enable logging and share what comes out?

[bryanidsts]

So I modified my app service config and set AZURE_LOG_LEVEL to debug
Loaded my website again
So now where do I go for the logs? I tried going in my app service to monitoring > Logs and querying AppServiceConsoleLogs, nothing

[vhvb1989]

Are you using https://graph.microsoft.com/oidc/userinfo -> oidc ?

Have you tried using https://graph.microsoft.com/v1.0/me ? You can see all the endpoints from the graph explorer: https://developer.microsoft.com/en-us/graph/graph-explorer

It will tell you what are the required modify permissions that you need for your app-registration.

Also, when you say GraphServiceClient, are you referring to the msgraph sdk? https://github.com/microsoftgraph/msgraph-sdk-java#23-get-a-graphserviceclient-object ?

[meyerovb]

Yes I got both urls to work, see #34177 (reply in thread)

Yes I’m trying to use that class from that sdk. I just have no idea how to do that with the x-ms-token-aad-access-token header. Which tokencredential type should I be using?

[bryanidsts]

@cgillum I tried your method from here but it just returned AADSTS50013: Assertion failed signature validation. [Reason - Key was found, but use of the key to verify the signature failed. Any feedback on how to actually use the x-ms-token-aad-access-token to call microsoft graph in java?

[meyerovb]

@billwert @baywet @vhvb1989 thank you all so much for your help, it was very nice to have some of the Microsoft team helping me through this headache. I now fully understand what’s going on here and have explained it all in a feature request for the Java graph sdk. Thanks again!