We have a webapplication that uses openid connect, with azure as the identityprovider, to sign in users. So users, when signing in is sent to a URL like:
https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize?response_type=id_token+token&client_id=3{clientId}&response_mode=form_post&redirect_uri=http://localhost:8765/ms/oidc/signon/response&scope=openid+profile+https://graph.microsoft.com/user.read&state=1234&nonce={nonce}
this works fine, but requires users to consent to our apps permission scopes the first time they use it.
We'd like to offer office365 administrators the ability to consent on behalf of their entire tenant, so we send them to an endpoint like:
https://login.microsoftonline.com/common/adminconsent?client_id={clientId}&state=12345&redirect_uri=http://localhost:8765
this also seems to work fine, and the admin i informed that they will consent on behalf of all users in their tenant. However, the user is still presented with the consent prompt on first login.
This does make sense, since the app is only registered with the user.read permission, so if we instead sent the user to
https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize?response_type=token&client_id={clientId}&response_mode=form_post&redirect_uri=http://localhost:8765/ms/oidc/signon/response&scope=https://graph.microsoft.com/user.read&state={state}&nonce={nonce}
without the dynamic permission request, and response type only set to token, the admin consent works, and users are not presented with the consent prompt.
So, I guess I have 2 questions:
1) is this how it's supposed to work, or is there some way to grant admin consent to the profile and openid scopes?
2) Am I actually missing anything by not requesting these(openid+profile) permissions? I don't receive and id_token in the response, but is seems the authentication_token already contains even more information than the id_token does anyway
1) is this how it's supposed to work, or is there some way to grant admin consent to the profile and openid scopes?
It seems a bug in azure ad v2.0 consent framework , well-known scopes(openid,profile) should be granted by default when you do admin permissions. Please refer to this link .
2) Am I actually missing anything by not requesting these(openid+profile) permissions? I don't receive and id_token in the response, but is seems the authentication_token already contains even more information than the id_token does anyway
You don't use OpenID connect since you haven't added the openid scope ,so id_token is not returned . But since you have the user.read permission of microsoft graph api , you could use microsoft graph api to read the user's basic information . Id_token and access token are different ,the id_token is used to identify the authenticated user. The access_token is used to prove access rights to protected resources . Please click here for more details.
Related
I have a Azure Active Directory application and I have provided some of the user delegated permissions for accessing Graph APIs. For example 'user.read' and 'user.read.all' etc.
To provide User Consent for the Graph APIs which have Delegated permission. I need to login using my credentials to the test application (I developed) and then there will be a Popup displayed on the Web UI with title "Permissions requested" to grand the consent. I need to select Accept button to grand the consent.
My questions:
Is there a way we can preauthorize the user consent without following Web UI flow?
Just like the admin consent in Active Directory, is there a way to grant user consent?
Yes, it is possible through MS Graph API.
When you grant user consent, an OAuth2PermissionGrant object is created.
Admin consent also creates one but in that one the principal is set to be "all users".
You can also create these programmatically.
You can see the docs for the API endpoint here.
It is created under the service principal of your app and you specify consentType as "Principal" and principalId as the user's objectId.
I think you may try to hit this url and signed in with the admin account, then you may consent on behalf of your organization. This url is used to get auth code for using auth code flow(generate access token)
https://login.microsoftonline.com/hanxia.onmicrosoft.com/oauth2/v2.0/authorize?
client_id=your_azure_ad_app_clientid
&response_type=code
&redirect_uri=http%3A%2F%2Flocalhost:8080%2F
&response_mode=query
&scope=user.read
&state=12345
Our app implements Azure OAuth2 (v2) user-consent flow and uses Graph API scopes that do not require admin consent oauth2 user. Recently we've noticed that some users of our app run into this Auth screen: "The app requires admin's approval".
Is that because the tenant Org disabled user-consent for apps?
Where does it leave us with the user-consent based OAuth2 flow? Is it still possible to get a user access token after an admin's approval or the only way is to use the OAuth2 daemon flow oauth2 daemon? In a callback after such a dialog how can we know that the admin approval has been given?
One related question. In cases where user-consent is not disabled but it's an admin user that authorizes there is an option 'Consent on behalf of your Organization". How can we know in the callback from this dialog that the admin checked that box? And does it mean we need to use the OAuth2 daemon flow then too?
Thank you
It was our lack of understanding. After more testing we realized that we used prompt=consent and that is why the consent window always showed. Thank you.
Is that because the tenant Org disabled user-consent for apps?
Yes, this settings is under Enterprise applications->User settings.
Is it still possible to get a user access token after an admin's
approval
Yes, you can still get a user access token after an admin's approval.
In a callback after such a dialog how can we know that the admin
approval has been given?
Once your admin reviews the request you will be notified via email.
In cases where user-consent is not disabled but it's an admin user
that authorizes there is an option 'Consent on behalf of your
Organization". How can we know in the callback from this dialog that
the admin checked that box?
Once the admin checked the box, the users under that tenant will not see the consent dialog. Also, you can check the status of the application in Azure portal->App registrations->your app->API permissions.
There are two possible reasons users consent or adminconsent
For user consent two possible cases
1)In a tenant where user consent is disabled, for example, users can't consent to any permission. Azure AD-- > Enterprise apps ---> User settings ---> Users can consent to apps.
2) User assignment :Azure AD--- > Enterprise apps-- > (select app) --> Properties --> User assignment required
For Admin Consent two possible cases
1) App-only permissions always require a tenant administrator’s consent. If your application requests an app-only permission and a user tries to sign in to the application, an error message is displayed saying the user isn’t able to consent.
2) Certain delegated permissions also require a tenant administrator’s consent. For example, the ability to write back to Azure AD as the signed in user requires a tenant administrator’s consent.
Solution :
The prompt=admin_consent parameter(which request permissions from admin) can be used as a parameter in the OAuth2/OpenID Connect authorization request to grant the admin consent .
Enable the admin consent workflow , which gives end users a way to request access to applications that require admin consent.
Refer the permissions documentation for the Microsoft Graph API indicate which permissions require admin consent.
I am able to read other users email using microft.graph api. Need guidance as how to restrict mailbox access so that users can view its email alone.
I created an azure admin and added 3 users. I registered an app and granted Mail.ReadWrite api permission. I generated a token and was able to read others users email. Need guidance as how mailbox access can be restricted to specific user and particular user can access their own email
Need guidance as how to restrict the users from accessing other users email
Client credential allows the app to read all the information that it have access to without a user. It means that anyone who opens the app can see the information. See Get access without a user.
What you need is Get access on behalf of a user.
To get an access token, the user is redirected to the Microsoft identity platform /authorize endpoint. In the authorization code grant flow, after consent is obtained, Azure AD will return an authorization_code to your app that it can redeem at the Microsoft identity platform /token endpoint for an access token.
At last, use this access token to access the emails of the logged in user. You won't see other users' emails.
I was able to restrict my app to access specific user email by creating an application policy. This link helped me to achieve this https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access Now I am using client credential to generate app level token and access specific users email.
This is in continuation with my other question.
I had to finally get the user in question the admin role and then I created a new application registration at https://apps.dev.microsoft.com/
The application was granted admin consent by hitting https://login.microsoftonline.com/common/adminconsent?.. endpoint with the required parameters.
Everything works fine and I was even able to create the outlook mail subscription for this user.
The issue though is, the endpoint https://login.microsoftonline.com/common/oauth2/v2.0/token is not giving me the refresh_token. I tried including the offline_access (reference - http://massivescale.com/microsoft-v2-endpoint-primer/) in the scope for getting the authorization code, but got the following error -
AADSTS65001: The user or administrator has not consented to use the application.
So the situation is like this -
If I use v1.0 endpoint, I get both access and refresh token but
hitting the endpoint
https://outlook.office.com/api/v2.0/Users('dummy#example.com')/subscriptions
sends back a 401 Unauthorized. I understand that the endpoint targets v2.0 but I didn't find one for v1.0.
However, If I use v2.0 endpoint, I am able to create the subscription but only get the access token which is shortly lived and this creates a need for going through this whole process again which I don't want.
As a commenter indicated, you've registered an Azure AD v2.0 application, and are calling the Azure AD v1.0 endpoints. This isn't strictly the problem you're facing, but I recommend reconfiguring your auth endpoints to be for v2.0.
https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize
https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
I think the issue you may be running into is not configuring static permissions before calling the admin consent endpoint. One of the new features of Azure AD v2.0 is dynamic consent & scopes that allow you to ask for new permissions when requesting them; however, for admin consent you must configure these as static permissions.
You can configure static permissions in Azure AD v2.0 inside the App Reg Portal through the UI below:
Then try hitting the admin consent endpoint again, and finally re-requesting the refresh token with the offline_access scope.
We have created a converged application for a public community(AD & live users can login) using Microsoft Graph and the scopes openid, email, profile and user.readBasic.all.
Every thing works fine for live users but some of AD users are not able to login. When they try to login they get the message as
"App needs permission to access resources in your organization that
only an admin can grant. Please ask an admin to grant permission to
this app before you can use it."
as per Microsoft document we have prepared admin consent url as
https://login.microsoftonline.com/<TenantID>/oauth2/authorize?client_id=<AppID>&response_type=code&redirect_uri=<RedirectURI>&prompt=admin_consent
After admin consent also users are not able to login to the app. Please help us what we are missing here.
Your URL is for the v1 Endpoint, not the v2 Endpoint (aka converged endpoint).
It should look like this (line break for readability):
https://login.microsoftonline.com/common/adminconsent?
client_id=[APPLICATION ID]&redirect_uri=[REDIRECT URI]
Note that is it /adminconsent rather than /authorize and there isn't a prompt query parameter. Also keep in mind that you'll need to ensure your registration includes the scopes you want the consent for.
I've written an article that walks you through the entire process that should prove helpful here: v2 Endpoint and Admin Consent