oauth - Azure Graph API: authorize application on multiple tenants -
i trying create application browse contacts directory on exchange.
have set , able request authorization app.
can present modal view, enter login information, retrieve token, when try authorize app same account have created message:
the client <my app id> , resource <my app uri> identify same application.
if try authorize account, receive message instead:
user account <an email> external identity provider <a url> not supported application <my app id>
if try login on graph explorer console or on office 365 oauth sandbox, work fine second address, not first one.
i confuse. feel have mess configuration option, don't understand one.
regarding #1, please not pass app id
of application resource
querystring parameter when authenticating against tenant url. ran exact same problem.
then ran webapp-multitenant-openidconnect-dotnet
github , noted down sign-in url created , used following:
var signinurl = string.format( "https://login.windows.net/{0}/oauth2/authorize?response_mode=form_post&response_type=code+id_token&scope=openid+profile&client_id={1}&resource={2}&redirect_uri={3}&state={4}&nonce={5}", uri.escapedatastring(tenantid), uri.escapedatastring(clientid), uri.escapedatastring("https://graph.windows.net"), uri.escapedatastring(redirecturi), uri.escapedatastring(state), string.format("{0}{1}", datetime.utcnow.ticks, guid.newguid().stringify()) );
basically used https://graph.windows.net
instead of app id
, magically things started work :).
another thing try (and have not tried it) authenticating against common endpoint https://login.windows.net/common/oauth2/authorize
, provide app id
resource
querystring.
Comments
Post a Comment