Btukfyl

I am trying to allow access to Microsoft accounts using the instructions here https://docs.microsoft.com/en-us/graph/auth-v2-user.

I have the first two steps working, the issue is occurring when I try to use the Authorisation Code that is returned after the user has granted permission to the application.

I am a bit confused because in the example above the Authorization response has an Authorization Code that looks like a GUID with an extra character at the start. From the example: M0ab92efe-b6fd-df08-87dc-2c6500a7f84d. This looks like what I am getting.

However in step three, Getting a Token, the Authorization code now looks very different. Again from the example: OAAABAAAAiL9Kn2Z27UubvWFPbm0gLWQJVzCTE9UkP3pSx1aXxUjq3n8b2JRLk4OxVXr... I am guessing that this is a Base64 string of some sort but I tried simply encoding the GUID like code from the previous step but that hasn't worked.

Am I missing a step here that somehow turns the initial Authorization code into a new format?

If I use the Authorization code that I receive directly I get a 401 response when trying to get an Access Token.

Relevant code below (c# and ASP.NET core 2.1).

Requested permissions:

"User.Read Mail.ReadWrite"

Link to request authorisation:

$"https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id={appId}" +

   $"&response_type=code" +

   $"&redirect_uri={responseUrl}" +

   $"&response_mode=query" +

   $"&scope={permissions}" +

   $"&state={userManager.GetUserId(User)}";

Action to receive authorisation response:

[HttpGet]

[Route("authentication/ms/receive-response/")]

public async Task<IActionResult> ReceiveAuthResponse(string code, string state)

{

    ApplicationUser applicationUser = await UserManager.GetApplicationUser(User);



    OfficeLinkConfiguration officeLinkConfiguration = new OfficeLinkConfiguration

    {

        ApplicationId = configuration.GetSection("OfficeLink").GetValue<string>("ApplicationId"),

        RequestedPermissions = configuration.GetSection("OfficeLink").GetValue<string>("RequestedPermissions"),

        RedirectUrl = configuration.GetSection("OfficeLink").GetValue<string>("ResponseUrl"),

        ClientSecret = configuration.GetSection("OfficeLink").GetValue<string>("Password"),

    };



    OfficeLinkProvider officeLinkProvider = new OfficeLinkProvider(officeLinkConfiguration, tokenStore);



    await officeLinkProvider.RequestAccessToken(applicationUser, code);



    return Redirect("/");

}

Request Access Token:

public async Task RequestAccessToken(ApplicationUser user, string authorisationCode)

{

    string tokenUrl = "https://login.microsoftonline.com/common/oauth2/v2.0/token";



    string postBody = $"client_id={Configuration.ApplicationId}" +

                      $"&scope={Configuration.RequestedPermissions}" +

                      $"&code={authorisationCode}" +

                      $"&redirect_uri={Configuration.RedirectUrl}" +

                      "&grant_type=authorization_code" +

                      $"&client_secret={Configuration.ClientSecret}";



    using (WebClient webClient = new WebClient())

    {

        webClient.Headers[HttpRequestHeader.ContentType] = "application/x-www-form-urlencoded";



        string result = await webClient.UploadStringTaskAsync(tokenUrl, postBody);



        TokenResponse tokenResponse = JsonConvert.DeserializeObject<TokenResponse>(result);



        HandleAuthorisationResponse(user, tokenResponse);

    }



}

I was able to fix this by deleting the existing Application Password (secret) and creating a new one.