Azure Data Lake Storage Gen2访问令牌生成-“ AADSTS65001：用户或管理员未同意使用ID为ID的应用程序

Question

I'm trying to generate access and refresh tokens to be able to sign in to the Azure Data Lake Storage Gen2 using external application with allows OAuth.

What was done:

1. Created Storage account using https://docs.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-quickstart-create-account

2. Created Azure AD application using https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal

3. Granted admin consent to application from the 2nd step - https://i.imgur.com/myMtkeu.png

4. Also granted admin consent to enterprise apps with name as the app from step 2 https://i.imgur.com/BPX48NE.png

Steps 3 and 4 were done as described here - https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent#grant-admin-consent-when-registering-an-app-in-the-azure-portal

Then I generated authorization code

https://login.microsoftonline.com/<TENANT ID>/oauth2/v2.0/authorize?client_id=<CLIENT ID>&response_type=code&redirect_uri=https%3A%2F%2Flocalhost%2Fmyapp%2F&response_mode=query&scope=offline_access%20user.read%20mail.read&state=12345

After that I tried to get the token

curl -X POST https://login.microsoftonline.com/<TENANT ID>/oauth2/token \
 -F redirect_uri=https://localhost/myapp/ \
 -F grant_type=authorization_code \
 -F resource=https://management.core.windows.net/ \
 -F client_id=<CLIENT ID> \
 -F client_secret=<CLIENT SECRET> \
 -F code=OAQABAAIAAAAP0wLlqdLVToOpA4kwzSnxLhHJrARX8557... (Authorization code)

As a result received the error below

"error":"invalid_grant","error_description":"AADSTS65001: 
The user or administrator has not consented to use the application with ID
'<CLIENT ID>' named '<APP NAME>'. Send an interactive authorization request 
for this user and resource.\r\nTrace ID: <TRACE ID>\r\nCorrelation ID: 
<CORRELATION ID>\r\nTimestamp: 2019-09-03 13:31:50Z","error_codes":[65001],
"timestamp":"2019-09-03 13:31:50Z","trace_id":"<TRACE ID>",
"correlation_id":"<CORRELATION ID>","suberror":"consent_required"```

Answer 1

You got the authorization code by using V2.0 endpoint, but you used v1.0 when you got the token. And the value of resource is not correct.

Try with below

Get authorization code

https://login.microsoftonline.com/<TENANT ID>/oauth2/authorize?client_id=<CLIENT ID>&response_type=code&redirect_uri=https%3A%2F%2Flocalhost%2Fmyapp%2F&response_mode=query&resource=https://datalake.azure.net/&state=12345

get the token

curl -X POST https://login.microsoftonline.com/<TENANT ID>/oauth2/token \
 -F redirect_uri=https://localhost/myapp/ \
 -F grant_type=authorization_code \
 -F resource=https://datalake.azure.net \
 -F client_id=<CLIENT ID> \
 -F client_secret=<CLIENT SECRET> \
 -F code=OAQABAAIAAAAP0wLlqdLVToOpA4kwzSnxLhHJrARX8557... (Authorization code)