8

I'm getting Your access token has expired. Please renew it before submitting the request. when I call https://graph.windows.net/myorganization/oauth2PermissionGrants?api-version=1.5 endpoint.

To prevent any stupid questions - Yes, I know that using Microsoft Graph is recommended instead of Azure AD Graph. I'm aware of it and I'm using it. But for my current case I need to request exactly Azure AD Graph.

Tests case:

  1. I successfully login on https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=.... and get code in the response.
  2. I successfully exchange code and get access_token on https://login.microsoftonline.com/common/oauth2/v2.0/token.
  3. I successfully make requests to any Microsoft Graph endpoint (ie https://graph.microsoft.com/education/me/classes).
  4. I call https://graph.windows.net/myorganization/oauth2PermissionGrants?api-version=1.5.
  5. I get the error Authentication_ExpiredToken Your access token has expired. Please renew it before submitting the request.
  6. I successfully make requests to any Microsoft Graph endpoint, so the access_token is valid.

Based on this article: https://learn.microsoft.com/azure/active-directory/develop/active-directory-appmodel-v2-overview, I can use this access token to access both Microsoft Graph API as well as Azure AD Graph API.

So, I'm using v2.0 which should work for those: https://learn.microsoft.com/azure/active-directory/develop/active-directory-protocols-oauth-code.

What I'm doing wrong?

Thank you!

Improve this question
7
  • Hmm, I could not find a mention that you can use the token for both APIs. I also did not read any mentions that you could Azure AD Graph with v2 :) OAuth permission grants should be available from the beta endpoint for MS Graph so do you need access to it? Commented Mar 9, 2018 at 11:27
  • From learn.microsoft.com/en-us/azure/active-directory/develop/… Active Directory (Azure AD) uses OAuth 2.0 to enable you to authorize access to web applications and web APIs in your Azure AD tenant. This guide is language independent, and describes how to send and receive HTTP messages without using any of our open-source libraries. Commented Mar 9, 2018 at 11:54
  • I don't want to use beta endpoint.There is msdn.microsoft.com/en-us/library/azure/ad/graph/api/… I'd like to use. Commented Mar 9, 2018 at 11:55
  • 1
    That documentation is for v1. You are using v2. Commented Mar 9, 2018 at 11:55
  • 1
    Well, I have not tried that :) Some scopes do overlap between the two APIs, but usually you need a token per API since the audience in the token is set to always target one API. Commented Mar 9, 2018 at 12:00

1 Answer 1

Reset to default
21

A token used to call the Microsoft Graph cannot be used to call the Azure AD Graph API.

When you look at the access token from Azure AD, there is a parameter called aud which stands for "audience". This property tells the API receiving the token the valid audience for that token.

If I own an API, "WebAPI1", and I get a token where the audience is something else, like "WebAPI2", I should reject that token, and not give the client access to my APIs. The reasons for this behavior should be obvious, but it causes major security issues if this check does not occur.

The aud value for the Microsoft Graph is https://graph.microsoft.com/ while the aud for Azure AD Graph API is https://graph.windows.net/.

When requesting an access token, you need to specify which specific resource you want a token for using the scopes parameter. This and more information can be found here.

The solution here is to get a different access token for the different API, and your issues should be resolved.

Let me know if this helps!

Improve this answer
Sign up to request clarification or add additional context in comments.

2 Comments

Thank you for such a great explanation! Now it's absolutely clear. The only thing that confused me is the response. It doesn't represent the problem correctly.
Totally agree there, but we would need more details about your authentication (like a raw token and a request trace) to know if it is an auth bug or just an error that appears before the other checks happen. For example, if at some point the graph checks for both expiration and aud, but does expiration first and your token is expired, then it would throw the first error without looking at all the rest... Just a hypothesis

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.