使用 Java 从 AAD 访问 MS Graph 用户数据

Question

I am trying to access MS Graph for an AAD account using Java. It is to fetch all User Data. When trying to access MS Graph I get 401 error:

            ClientCredentialParameters clientCredentialParam = ClientCredentialParameters.builder(
                            Collections.singleton("https://graph.microsoft.com/.default"))
                    .build();

            CompletableFuture<IAuthenticationResult> future = app.acquireToken(clientCredentialParam);

            URL url = new URL("https://graph.microsoft.com/v1.0/users");
            HttpURLConnection conn = (HttpURLConnection) url.openConnection();

            conn.setRequestMethod("GET");
            conn.setRequestProperty("Authorization", "Bearer " + future.get());
            conn.setRequestProperty("Accept","application/json");

            int httpResponseCode = conn.getResponseCode();
            if(httpResponseCode == HTTPResponse.SC_OK) {

                try (BufferedReader in = new BufferedReader(new InputStreamReader(conn.getInputStream()))) {
                    String inputLine;
                    while ((inputLine = in.readLine()) != null) {
                        responseString.append(inputLine);
                    }
                }
            }
          return responseString.toString();

Scope and other permissions are given. I am getting following result. Hope anyone can guide me to resolve the issue.

Answer 1

This is my latest code. I used the function getAccessTokenByClientCredentialGrant to fetch access token and called the GET api call manually by adding access token to the header. Using graph client is the best practice as of my knowdeldge.

            String CLIENT_ID = "{{ClientId}}";
            String CLIENT_SECRET = "{{ClientSecret}}";
            String AUTHORITY = "https://login.microsoftonline.com/{{TenantId}}";
            Set<String> SCOPE = Collections.singleton("https://graph.microsoft.com/.default");
        try {

            String access_token = getAccessTokenByClientCredentialGrant(CLIENT_ID, CLIENT_SECRET,
                    AUTHORITY, SCOPE).accessToken();

            URL url = new URL("https://graph.microsoft.com/v1.0/users");
            HttpURLConnection conn = (HttpURLConnection) url.openConnection();

            conn.setRequestMethod("GET");
            conn.setRequestProperty("Authorization", "Bearer " + access_token);
            conn.setRequestProperty("Accept","application/json");

            int httpResponseCode = conn.getResponseCode();
            JsonPointer responseString = null;
            if(httpResponseCode == HTTPResponse.SC_OK) {

                try (BufferedReader in = new BufferedReader(new InputStreamReader(conn.getInputStream()))) {
                    String inputLine;
                    while ((inputLine = in.readLine()) != null) {
                       response.put(RESULT, responseString.toString());
                    }
                }
            }
          
        } catch (Exception e) {
            e.printStackTrace();
        }
        System.out.println("Response "+responseString);

And getAccessTokenByClientCredentialGrant function goes like this:

 private IAuthenticationResult getAccessTokenByClientCredentialGrant(String client_id, String client_secret, String authority, Set<String> scope) throws MalformedURLException, ExecutionException, InterruptedException {
    ConfidentialClientApplication app = ConfidentialClientApplication
            .builder(client_id, ClientCredentialFactory
                    .createFromSecret(client_secret))
            .authority(authority).build();

    ClientCredentialParameters clientCredentialParam = ClientCredentialParameters
            .builder(scope).build();

    CompletableFuture<IAuthenticationResult> future = app.acquireToken(clientCredentialParam);
    return future.get();
}

Suggested readings: https://blogs.aaddevsup.xyz/2021/08/microsoft-graph-why-you-cannot-call-the-me-endpoint-with-a-token-acquired-via-the-client-credentials-grant-flow/