What is the proper way to work with the OneDrive API?

Question

I want to interact with OneDrive in my WinForms application. Sadly, the Azure quick start samples do not include WinForms, just UWD.

The flow on what I have to do is consistent, namely given my Client ID , I have to obtain an Authentication Code . Given the authentication code, I can then obtain an Access Code , which will allow me to interact in a RESTful way with the OneDrive API. My plan is to have the authentication piece go in a .Net Framework Library and the file IO calls will go in another library that has no user interface access, as it will go in a Windows Service. I would pass the Access Token to the service.

AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials.

This error corresponds to the following code fragment that I lifted from the sample.Net Core daemon quick start code.

Note: I was playing around with Scopes as I kept receiving scope errors and I saw one article, whose link I should have kept, which stated to use the API and default scope.

public bool GetRestAuthenticationToken(out string tokenAuthentication)
    {
        tokenAuthentication = null;
        try
        {
            IConfidentialClientApplication app;
            app = ConfidentialClientApplicationBuilder.Create(Authenticate.AppClientId)
                                                      .WithClientSecret(Authenticate.AppClientSecret)
                                                      .WithAuthority(new Uri(@"https://login.microsoftonline.com/common/oauth2/nativeclient"))
                                                      .Build();


            string scope = $"onedrive.readwrite offline_access";
            System.Collections.Generic.List<string> enumScopes = new System.Collections.Generic.List<string>();
            enumScopes.Add("api://<GUID>/.default");
            //enumScopes.Add(Authenticate.Scopes[1]);
            var result = Task.Run(async () => await app.AcquireTokenForClient(enumScopes).ExecuteAsync()).Result;
            ...
        }
        ...
}

I believe that I have my application configured properly now on Azure, but am not 100% positive.

API Permissions:

Authentication:

• Desktop Applications: https://login.microsoftonline.com/common/oauth2/nativeclient
• Desktop Applications: https://login.live.com/oauth20_desktop.srf
• Implicit Grants: Access tokens & ID tokens
• Live SDK support (Yes)
• Default client type (Yes)

Others:

• I do have a client secret and kept note of all the Overview GUIDs

Microsoft Doc 1

I tried several different URLs, but only the one not commented out works with the fragment above, but throws the referenced error.

            //string redirect_uri = @"https://www.myapp.com/auth";
            //string redirect_uri = "https://login.live.com/oauth20_desktop.srf";
            string url = @"https://login.microsoftonline.com/common/oauth2/nativeclient";
            //string url = $"https://login.live.com/oauth20_authorize.srf?client_id={appClientId}&scope={scope}&response_type=code&redirect_uri={redirect_uri}";
            //string url = $"https://login.microsoftonline.com/common/oauth2/v2.0/authorize?" +
            //                $"client_id={Authenticate.AppClientId}&" +
            //                $"scope={scope}&" +
            //                $"response_type=token&" +
            //                $"redirect_uri={redirect_uri}";

The goal is the same, namely to obtain an access token that I can use with RESTful calls to work with files and/or directories on OneDrive, eg

            System.Net.Http.HttpClient client = new System.Net.Http.HttpClient();
            client.GetAsync(...);

Answer 1

You are trying to implement Client credentials grant type to get the access token.

Based on MSAL initialization , Authority is

( Optional ) The STS endpoint for user to authenticate. Usually https://login.microsoftonline.com/{tenant} for public cloud, where {tenant} is the name of your tenant or your tenant Id.

We assume that your tenant is "myTenent.onmicrosoft.com", then you should set it as https://login.microsoftonline.com/myTenent.onmicrosoft.com here.

I notice that you specify a scope "onedrive.readwrite" in your code. But it's not a valid permission of Microsoft Graph. The default scope of Microsoft Graph is https://graph.microsoft.com/.default .