'Azure App Registration and (ConfidentialClientApplication) returns Account NULL and Token not working for querying GraphApi (401)
I'm using the following code in a console application to identify it as registered azure app.
//https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/wiki/Client-credential-flows
var currentClaims = ClaimsPrincipal.Current; //currentClaims null
var app = ConfidentialClientApplicationBuilder.Create(settings.ClientId)
.WithClientSecret(settings.ClientSecret)
.WithTenantId(settings.TenantId)
.WithAuthority(new Uri(settings.Authority))
.Build();
app.AddInMemoryTokenCache();
AuthenticationResult result = null;
AccessToken? _accessToken = null;
try
{
result = await app.AcquireTokenForClient(scopes: new[] { settings.ScopeApplicationIDURI }) //api://ConsoleApp1AppRegistrationAzure/.default
.ExecuteAsync();
_accessToken = new AccessToken(result.AccessToken, result.ExpiresOn);
}
catch (MsalServiceException ex) when (ex.Message.Contains("AADSTS70011"))
{
// Invalid scope. The scope has to be of the form "https://resourceurl/.default"
// Mitigation: change the scope to be as expected
}
Acquireing the token works and I receive the following result like:
| Variable | Content | Type |
|---|---|---|
| result | {Microsoft.Identity.Client.AuthenticationResult} | |
| AccessToken | "eyJ0eXAiOiJKV1....tg" | string |
| Account | null | Microsoft.Identity.Client.IAccount |
| AuthenticationResultMetadata | {Microsoft.Identity.Client.AuthenticationResultMetadata} | |
| ClaimsPrincipal | null | System.Security.Claims.ClaimsPrincipal |
| CorrelationId | {6cdf59da-632c-4cbd-b1f3-5cb615a87391} | System.Guid |
| ExpiresOn | {3/5/2022 3:27:51 PM +00:00} | System.DateTimeOffset |
| ExtendedExpiresOn | {3/5/2022 3:27:51 PM +00:00} | System.DateTimeOffset |
| IdToken | null | string |
| IsExtendedLifeTimeToken | false | bool |
| Scopes | Count = 1 | System.Collections.Generic.IEnumerable |
| SpaAuthCode | null | string |
| TenantId | null | string |
| TokenType | "Bearer" | string |
| UniqueId | null | string |
However, why is result.Account null? Shouldn't I receive an account with a claim with access_as_application. This is how the app looks like in Azure:
How can I recieve with result.Account an account with the claims.
Also, querying the graph api or my app configuration (where my app has a reader role) returns 401 when using the access token.
GET https://graph.microsoft.com/v1.0/me HTTP/1.1
Host: graph.microsoft.com
Accept: application/json
Authorization: bearer eyJ0eXAi...
[Edit] Thanks to @Gaurav Mantri, I found https://docs.microsoft.com/en-us/graph/auth-v2-service#4-get-an-access-token which solves the second part of the question.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|

