Hello Microsoft/Azure/Skype experts,
I'm tasked with accessing presence data from Skype For Business Online accounts from my macOS app (native).
I'm unfortunately stuck and i always get a 403 error when i access the autodiscover request and never get the link to the applications resource
I have been following this documentation
https://learn.microsoft.com/en-us/skype-sdk/ucwa/authenticationusingazuread
STEP 1
We have registered the app in the Azure Management Portal using our Office 365 account credentials.
We have used custome redirect URL (http://localhost)
Allow Implicit Flow is set to true in manifest
We pre-configure the permissions needed for Skype for business
online
STEP 2
Issuing a GET as specified in the documentation to initiate sign in and authorization check.
GET https://login.microsoftonline.com/common/oauth2/authorize?response_type=token&client_id=c#####-4d41-485e-871f-0a22aa79e52b&redirect_uri=http://localhost
This returns a 200 OK.
STEP 3
We got the Auto discover URL as described in the documentation.
This is what i get - i use the domain marked in RED.
STEP 4
As per the documentation, they ask me to do this
Requesting an access token using implicit grant flow
So i issue a GET as described
https://login.microsoftonline.com/oauth2/authorize?
response_type=id_token &client_id=######-4d41-485e-871f-0a22aa79e52b
&redirect_uri=http://localhost
&state=8f0f4eff-360f-4c50-acf0-99cf8174a58b
&resource=https://webdirin1.online.lync.com
Now this shows the sign in page, i sign in and then it throws an error
AADSTS90014%3a+The+required+field+%27nonce%27+is+missing.
I researched and could not fix this error.
So after lots of research and looking at this Microsoft documentation LINK (https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#requesting-individual-user-consent) , apparently there is another way of getting the bearer token.
STEP 4 - SECOND TRY
I then Request individual user consent by sending the SCOPE parameter for Skype for Business.
I then issue a GET request to
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=#######-4d41-485e-871f-0a22aa79e52b&response_type=code&redirect_uri=http://localhost&response_mode=query&scope=https://api.skypeforbusiness.com/User.ReadWrite&state=12345
This returns an access code which i use in next step to get the TOKEN
STEP 5 - Get the bearer TOKEN
Issue a POST to following URL
https://login.microsoftonline.com/common/oauth2/v2.0/token With the
following data in POST body
"grant_type": "authorization_code", "client_id":
"######-4d41-485e-871f-0a22aa79e52b", "scope":
"https://api.skypeforbusiness.com/User.ReadWrite", "code":
"OAQABAAIAAACEfexX.........", "redirect_uri": "https://localhost"
This returns the bearer token in the following response JSON
{
"access_token" = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1........w4b-- gnWG_iOGtQ";
"expires_in" = 3599;
"ext_expires_in" = 3599;
scope = "https://api.skypeforbusiness.com/User.ReadWrite";
"token_type" = Bearer;
}
STEP 6
Yay! Got the bearer token at laaast!
Now back to the main documentation
https://learn.microsoft.com/en-us/skype-sdk/ucwa/authenticationusingazuread
And where we do this - 'Resending an autodiscovery request with the bearer token'
We execute a GET request to
https://webdirin1.online.lync.com/Autodiscover/AutodiscoverService.svc/root/oauth/user
Now this, as per the documentation should return this JSON
{
"_links":{
"self":
{"href":"https://webdirX.online.lync.com/Autodiscover/AutodiscoverService.svc/root/user"},
"applications":
{"href":"https://webpoolXY.infra.lync.com/ucwa/oauth/v1/applications"}
}
}
BUT i GET A 403: PERMISSIONS denied error
<div class="content-container"><fieldset>
<h2>403 - Forbidden: Access is denied.</h2>
<h3>You do not have permission to view this directory or page
using the credentials that you supplied.</h3>
</fieldset></div>
So thus i have never got the applications url and I have checked the manifest, registration and i have no idea, why i get this error.
Any inputs would be appreciated.
For step 4, you need to specify nonce=somestring in the URL. Typically this should be a securely random value that is only used once. It can contain any value.
Also, you are only requesting an id token. Set response_type=id_token+token.
Related
I tried to use below mixpanel API for fetching event data.
Link
But I am facing a below 403 forbidden error.
{
"request": "/api/2.0/events",
"error": "You do not have the required scope(s) for this request"
}
It seems to be like some permission is missing for accessing the API. But I can't able to find out where to set this scope
Please help me how to get rid of this error
We've found success with the schema if you generate a Service Account from the Organization/Project Settings and use those credentials when authorizing the request.
To do this, go to your Organization Settings, click "+ Service Account" and use the credentials that are generated in the request you submit.
(DocuSign Support Center directed me here)
We use DocuSign as an integration in another application but I still cannot generate the token through external services/tools and have not been able to get a solid answer from DocuSign support and was directed to post my question here.
"error": "Invalid client_id", "error_description": "One or both of Username and Password are invalid."
We have been using this DocuSign Account/Integrator Key for over a year with no problems up until now!
This error is related to generating the "OAuth2 Token". (I have included all relevant account information at the bottom of this text box for your convenience).
This issue presented itself just after the ticket was opened about the inquiry into the advanced API plan and maybe something got shuffled unknowingly that broke the account's status for which API plan was purchased because it looks like at first glance I am prompted to buy the "basic" plan still on our live account.
(Ran this through Postman)
https://www.docusign.net/restapi/v2/oauth2/token
password: "redacted",
client_id: "redacted",
grant_type: "password",
scope: "api",
username: "redacted"
The body of the response is as follows:
"error": "invalid_client",
"error_description": "One or both of Username and Password are invalid."
These are the exact credentials used to log in to the DocuSign portal itself so the error message is extremely confusing. I tried escaping password characters, changing the password, and even went so far as to create an entirely new integrator key by making a new sandbox account to run the 20 API calls to get it promoted assuming the problem was the key. I was able to successfully generate the OAuth Token for the demo.docusign.net account with the credentials for my sandbox account (the username used for the sandbox account was an entirely new account/email setup).
DocuSign has a demo (sandbox) environment for testing as well as it's core production environment. In the demo system all the API endpoints start with the following base URI:
https://demo.docusign.net/...
However when live in production your account may reside in one of many different data centers. For example, some possible sites are:
https://www.docusign.net/
https://na2.docusign.net/
https://na3.docusign.net/
https://eu.docusign.net/
...
I see you mention you are using Postman to test production API requests using https://www.docusign.net/... as you base, have you confirmed this is the correct base URI for your user/account? It's possible the account resides in a different data center and that would make sense why you are getting an invalid credentials error as it's not the right account.
Determining the correct base_uri for a given user of your app is done during the OAuth process, you need to make the Get User Info call and parse the base_uri that is returned in the response and use THAT for subsequent API calls.
I'm having an issues with the new API policy of Instagram
I already got my app approved and got basic permissions
IG API Permissions
When using the app on sandbox mode I can get API response only for my own user, however when I move to Live Mode and try using the API all I receive is error 400 code
For example
https://api.instagram.com/v1/users/search?access_token=MY-TOKEN&count=6&q=world
Response
{
meta: {
error_type: "OAuthPermissionsException",
code: 400,
error_message: "This client has not been approved to access this resource."
}
}
Even using the same API with my own username still getting the same error
I was trying to search on it but all I can find is the same error happens to unauthorized users
Any idea ?
I have fixed the This client has not been approved to access this resource Issue by Authorizing the Instagram public_content scope by visiting the following URL and clicking Authorize.
https://api.instagram.com/oauth/authorize/?client_id=[YOUR_CLIENT_ID]&redirect_uri=[YOUR_REDIRECT_URI]&scope=public_content&response_type=token
I found the reason, I can't use that endpoint because I have only permission for basic. for more information https://www.instagram.com/developer/endpoints/users/
Getting auth token from uber is a two step process.
Please refer Uber Auth API
Ask the uber user to authorize : call GET https://login.uber.com/oauth/v2/authorize?response_type=code&client_id={client_id}&redirect_uri={redirect_uri}
Provide your client_id and redirect_uri specific to your website. If the authorization is successful, you will be redirected to your site with the code in the query parameter.
The the code you get in step 1 to retrieve auth token.
Send an HTTP POST request to https://login.uber.com/oauth/v2/token. Following should be the json you send to server:
{
"client_secret": "{client_secret}",
"client_id": "{client_id}",
"grant_type": "{authorization_code}",
"redirect_uri": "{redirect_uri}",
"code": "{insert authorization code obtained in previous step}"
}
In the step two I always get a error 400 with "invalid grant type" message. Please suggest where am I going wrong.
You need to send the parameter as form-data, not JSON. Take a look at the curl example in section 3 here: https://developer.uber.com/docs/authentication
The authorization and authentication documentation doesn't mention anything about JSON, therefore application/x-www-form-urlencoded media type is to be used to send the HTTP POST request to the /oauth/v2/token API endpoint
I'm trying to acquire a 2 legged oauth2 access token for google's storage api through a service account.
The relevant documentation is contained here:
https://developers.google.com/identity/protocols/OAuth2ServiceAccount
I first tried attempted to acquire the token through their HTTP/REST api. I eventually gave up being unable to get past a 400 response with the following details:
{ "error" : "invalid_grant" }
I then turned to the recommended method: using the java Google api client library (I'm using scala).
val credentialBuilder = new GoogleCredential.Builder()
.setTransport(GoogleNetHttpTransport.newTrustedTransport())
.setJsonFactory(JacksonFactory.getDefaultInstance())
.setServiceAccountId(Configuration.GoogleAPI.ServiceAccount.email)
.setServiceAccountPrivateKeyFromP12File(new File(Configuration.GoogleAPI.ServiceAccount.pkcs12))
.setServiceAccountScopes(Collections.singleton(StorageScopes.DEVSTORAGE_FULL_CONTROL))
def updateToken = {
val credential = credentialBuilder.build()
credential.refreshToken()
// ... do stuff here with token
}
Running the above, I get a TokenResponseException, with a payload identical to the error I was getting directly accessing the REST api. 400 Bad Request, invalid_grant error.
Doing some research (on both stackoverflow and elsewhere), I find that the most common reasons for this error message are:
1) The local clock is not synced with Google's servers. I suspected this even back when I was using the REST api because I've encountered this issue for other services before. I'm fairly sure its not a clock issue however, because I have repeatedly synced my clocks with an external ntp server:
sudo ntpdate -s ntp.ubuntu.com
2) The other common cause for this error is setting the service account client ID incorrectly. Most people set it to their service account client id (ending with "apps.googleusercontent.com") instead of their service account client email. Its pretty clear that this isn't the problem, since I'm correctly pointing to the email (the docs instructed this, so I followed the directions), ending with "#developer.gserviceaccount.com".
I'm stuck. I've checked the user documentation, the javadocs, various forums. The error message isn't very helpful (probably designed that way, since it's a security endpoint).
What other possible causes for this error exist? What can I do to get my service account access token?
If you are using OAuth2.0 to access a google analytics account then there could be one more reason of getting invalid_grant. As per developer docs:
If the application attempts to use an invalidated refresh token, an
invalid_grant error response is returned. The limit for each unique
pair of OAuth 2.0 client and Google Analytics account is 25 refresh
tokens (note that this limit is subject to change). If the application
continues to request refresh tokens for the same Client/Account pair,
once the 26th token is issued, the 1st refresh token that was
previously issued will become invalid. The 27th requested refresh
token would invalidate the 2nd previously issued token and so on.