无法登录 login.microsoftonline.com oauth 2 授权端点

Question

I've tried different ways to connect the Microsoft sign in function which open a webpage so you can use things like sign in with MFA. I manage to get this to work in Postman and now im trying it in C# particularly in .NET MVC 5.

HomeController:

 public ActionResult TestAuth()
    {
        HttpClient client = new HttpClient();
        var bodyParams = new Dictionary<string, string>();
        bodyParams.Add("client_id", "{my_client_id}");
        bodyParams.Add("client_secret", "{my_client_secret}");
        bodyParams.Add("scope", "openid");
        bodyParams.Add("redirect_uri", "https://localhost");
        bodyParams.Add("grant_type", "authorization_code");
        var response = client.PostAsync("https://login.microsoftonline.com/{my_tenant_id}/oauth2/v2.0/authorize", new FormUrlEncodedContent(bodyParams)).Result;
        return View("TestAuth", new { response.Content.ReadAsStringAsync().Result });
    }

View TestAuth.cshtml:

@model dynamic
@Html.Raw(Model)

If i sign in with my email on that domain, or any text at all really, i get this message. I cannot see why this issue occurs it gives me zero information what to do next more than just trying until you make it basically:). I've looked at tons of different Microsoft documentations, Stack posts, forums etc but with no success.

The postman call example:

Is it possible I'm doing something wrong in the request in the c# code or am i missing something important like configurations in Azure AD etc?

I'm up for anything that will work that i can sign into a Microsoft account that use MFA, then i can use their login to fetch data from Microsoft Graph based on their permissions basically.

PS I also can fetch data with the access token generated from postman so it's working as expected. I only need to "convert the postman call to c#" to make it work esentially. Any help is appreciated:)

Answer 1

You're trying to do an oauth2 request from the controller. The request you're sending is incorrect.

Microsoft made a great sample on how to use the Microsoft identity platform in a dotnet application https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/tree/master/1-WebApp-OIDC

In a nutshell you redirect the user to the endpoint (so not a get/post from the controller, but actually a redirect 302 response to the token url). The user then has to login and is redirected to the webapplication. Your webapplication will get an authorization code that is has to exchange for an access token by a post request.

Postman does this for you, but in order to do it in dotnet core, just follow the sample.

Answer 2

I didn't find a soultion to this specific problem what i did find was another guide which led me to this github project https://github.com/Azure-Samples/ms-identity-aspnet-webapp-openidconnect Which had similar code in the Startup.cs file but actually had some examples like SendMail and ReadMail etc which was fetched from ms graph api. This gave me some idea of how this project was structured compared to mine. So one thing that was missing was this part I couldnt figure out:

IConfidentialClientApplication app = await MsalAppBuilder.BuildConfidentialClientApplication();
var account = await app.GetAccountAsync(ClaimsPrincipal.Current.GetAccountId());

So the Msal app builder which is a custom made thingy i needed to get the current user etc which i needed. This works fine and after that i can start doing requests to the graph api like adding scopes etc and make http request.

Example see groups:

        [Authorize]
        [HttpGet]
        public async Task<ActionResult> GetGroups()
        {
            IConfidentialClientApplication app = await MsalAppBuilder.BuildConfidentialClientApplication();
            var account = await app.GetAccountAsync(ClaimsPrincipal.Current.GetAccountId());
            string[] scopes = { "GroupMember.Read.All", "Group.Read.All", "Group.ReadWrite.All", "Directory.Read.All", "Directory.AccessAsUser.All", "Directory.ReadWrite.All" };
            AuthenticationResult result = null;
            HttpClient client = new HttpClient();
            HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Get, "https://graph.microsoft.com/v1.0/groups");
            try
            {
                //Get acccess token before sending request
                result = await app.AcquireTokenSilent(scopes, account).ExecuteAsync().ConfigureAwait(false);
                if (result != null)
                {
                    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", result.AccessToken);
                    //Request to get groups
                    HttpResponseMessage response = await client.SendAsync(request);

                    if (response.IsSuccessStatusCode)
                    {
                        ViewBag.Groups= response.Content.ReadAsStringAsync().Result;
                        return View("MyView");
                    }
                }
            }
            catch (Exception ex)
            {
                Response.Write($"Error occured:{System.Environment.NewLine}{ex}");
            }

            return View();
        }