Azure AD OAuth2 无效令牌

Question

I'm trying to client flow to authenticate OAuth2 to get the access token. Below is my codes:

var cca = ConfidentialClientApplicationBuilder
                 .Create("client id")
                 .WithTenantId("tenant id")
                 .WithClientSecret("client secret")
                 .Build();

var ewsScopes = new string[] { "https://outlook.office365.com/.default" };

var authResult = await cca.AcquireTokenForClient(ewsScopes).ExecuteAsync();

ExchangeService _service = new ExchangeService();

_service.Url = new Uri("https://outlook.office365.com/EWS/Exchange.asmx");
_service.Credentials = new OAuthCredentials(authResult.AccessToken); 
 _service.ImpersonatedUserId = new ImpersonatedUserId(ConnectingIdType.SmtpAddress, crmEmail);

It was able to generate the token. But when I try to access EWS email, it came out the following exception:

The format of value 'Bearer eyJ0eXAiOiJKV1QiLCJub25jZSI6Im9RSEFjaS1HWHlyTEprVFZFME5QZ0stXzdpMmpGejg5eXhiY3U2N2g3WXciLCJhbGciOiJSUzI1NiIsIng1dCI6Ii1LSTNROW5OUjdiUm9meG1lWm9YcWJIWkdldyIsImtpZCI6Ii1LSTNROW5OUjdiUm9meG1lWm9YcWJIWkdldyJ9.eyJhdWQiOiJodHRwczovL291dGxvb2sub2ZmaWNlMzY1LmNvbSIsImlzcyI6Imh0dHBzOi8vc3RzLndpbmRvd3MubmV0L2M4YzNkM2FkLTM3MTAtNDEwZC1iZGFhLTQyZDA4NGQ1OTVkNS8iLCJpYXQiOjE2NzE3MTk2OTksIm5iZiI6MTY3MTcxOTY5OSwiZXhwIjoxNjcxNzIzNTk5LCJhaW8iOiJFMlpnWUdqODVCUnUzdmsvZkZmM281a0h3dHA5QVE9PSIsImFwcF9kaXNwbGF5bmFtZSI6IkNSTS1FV1MiLCJhcHBpZCI6IjdlNTQ4MmI4LWMwMDAtNDM4MC04M2YxLWQwMTk4NjNlYTRiYyIsImFwcGlkYWNyIjoiMSIsImlkcCI6Imh0dHBzOi8vc3RzLndpbmRvd3MubmV0L2M4YzNkM2FkLTM3MTAtNDEwZC1iZGFhLTQyZDA4NGQ1OTVkNS8iLCJvaWQiOiJjZWVmYTI0OC1iMGJjLTRlZTMtYmJhZC0xMjZhNmM0NTkyOWUiLCJyaCI6IjAuQVNvQXJkUER5QkEzRFVHOXFrTFFoTldWMVFJQUFBQUFBUEVQemdBQUFBQUFBQUFxQUFBLiIsInJvbGVzIjpbImZ1bGxfYWNjZXNzX2FzX2FwcCJdLCJzaWQiOiI0ZDQ1YTc2NS00ZTk1LTRiM2UtYWEyYy0yNDQ2MGQ2ZWQ1ZDUiLCJzdWIiOiJjZWVmYTI0OC1iMGJjLTRlZTMtYmJhZC0xMjZhNmM0NTkyOWUiLCJ0aWQiOiJjOGMzZDNhZC0zNzEwLTQxMGQtYmRhYS00MmQwODRkNTk1ZDUiLCJ1dGkiOiJPcm5WejMwQUswaVctV2hMTVI3dEFBIiwidmVyIjoiMS4wIiwid2lkcyI6WyIwOTk3YTFkMC0wZDFkLTRhY2ItYjQwOC1kNWNhNzMxMjFlOTAiXX0.rSoLFZ8uu1Nyf3utEfbaLU_dWHUXaVwKtqDNlVgisNvLaFVvkmMAGYkuanmUoWL2PFKvKXEBspFzJsX_qO02a20xCIDKZI9_CjJicDcg36CxAolCFqt50VXhhm5ebVjh9cWWeYP9DFV028VGUJRhJ7hYM8Uusmk9kuXka6pKW7SpZ0fNT_SY14sceT5RvVW3Zi1DkO0lm_6btuXolqIHXUTvbrFPN7kt-_DiOBn6oZUb-sPoWUditRGTOe_AZ-f5tKubVGcxqMPXCUs82CYxKVoXrEqJb5ISXCLHzg-TS6xbc8N1UEBAqpaLvqlYqAiclzRDBTHDgC8ob1DIxqtp9Q' is invalid.

The token was generated from AuthResult.AccessToken. I've no clue where went wrong. Any advice appreciated.

Answer 1

I followed this document and compared it with yours code snippet, I have several points that want to confirm with you.

Firstly, did you set the api permission correctly? You may need to check if full_access_as_app permission was listed and give admin consent . Like screenshot below, I added the api permission but didn't grant admin consent.

Then the next, the document also provide a sample which set a request header:

ewsClient.HttpHeaders.Add("X-AnchorMailbox", "meganb@contoso.onmicrosoft.com");

By the way, also some preparation.

To use the code in this article, you will need to have access to the following:

A Microsoft 365 account with an Exchange Online mailbox. If you do not have a Microsoft 365 account, you can sign up for the Microsoft 365 Developer Program to get a free Microsoft 365 subscription. The Microsoft Authentication Library for .NET. The EWS Managed API.