{"id":7017,"date":"2023-03-12T15:34:58","date_gmt":"2023-03-12T15:34:58","guid":{"rendered":"https:\/\/rakhesh.com\/?p=7017"},"modified":"2023-03-12T15:34:58","modified_gmt":"2023-03-12T15:34:58","slug":"specifying-the-oauth2-authentication-token-scope","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/azure\/specifying-the-oauth2-authentication-token-scope\/","title":{"rendered":"Specifying the OAuth2 authentication token scope"},"content":{"rendered":"

When using Client Credentials flow I usually have some PowerShell like this:<\/p>\n

$authBody = @{\r\n    \"tenant\" = \"$tenantId\"\r\n    \"client_id\" = \"$appId\"\r\n    \"scope\" = \"xxxx\"\r\n    \"grant_type\" = \"client_credentials\"\r\n    \"client_secret\" = $clientSecret\r\n}\r\n\r\nWrite-Verbose \"Getting Azure AD token\"\r\n$aadtoken = Invoke-RestMethod -Method POST -Uri \"https:\/\/login.microsoftonline.com\/${tenantId}\/oauth2\/v2.0\/token\" -Body $authBody -ContentType \"application\/x-www-form-urlencoded\"\r\n\r\n$header = @{\r\n    \"Authorization\" = \"Bearer \" + $aadtoken.access_token\r\n}<\/pre>\n
And I am always stumped with the “scope” part.<\/p>\n
For other flows I can put a space separated list of scopes – like this:<\/p>\n
$authBody = @{\r\n    \"tenant\" = \"$tenantId\"\r\n    \"client_id\" = \"$appId\"\r\n    \"scope\" = \"User.Read openid\"\r\n}\r\n\r\nWrite-Verbose \"Getting Azure AD token\"\r\n$aadtoken = Invoke-RestMethod -Method POST -Uri \"https:\/\/login.microsoftonline.com\/${tenantId}\/oauth2\/v2.0\/devicecode\" -Body $authBody\r\n\r\n# There's more stuff to do...<\/pre>\n
But that doesn’t work with Client Credentials. You get an error:<\/p>\n
Client credential flows must have a scope value with \/.default suffixed to the resource identifier (application ID URI).<\/code><\/p>\n
The solution is simple, just that I keep forgetting. If I am authenticating against a particular App Registration (e.g. an App Registration is authorized to access a Logic App or Azure Function; and I use other App Registrations that are authorized to authenticate against the first App Registration) then I must use that App Registration Id with the “\/.default<\/code>“.<\/p>\n
$authBody = @{\r\n    \"tenant\" = \"$tenantId\"\r\n    \"client_id\" = \"$appId\"\r\n    \"scope\" = \"${appRegId}\/.default\"\r\n    \"grant_type\" = \"client_credentials\"\r\n    \"client_secret\" = $clientSecret\r\n}<\/pre>\n
But what if I am authenticating against Graph itself? Or some other resource? Then I must use a different URL like in this doc<\/a>. For Graph it would be:<\/p>\n
$authBody = @{\r\n    \"tenant\" = \"$tenantId\"\r\n    \"client_id\" = \"$appId\"\r\n    \"scope\" = \"https:\/\/graph.microsoft.com\/.default\"\r\n    \"grant_type\" = \"client_credentials\"\r\n    \"client_secret\" = $clientSecret\r\n}<\/pre>\n
But it would be, say, the following for Azure Key Vault:<\/p>\n
$authBody = @{\r\n    \"tenant\" = \"$tenantId\"\r\n    \"client_id\" = \"$appId\"\r\n    \"scope\" = \"https:\/\/vault.azure.net\/.default\"\r\n    \"grant_type\" = \"client_credentials\"\r\n    \"client_secret\" = $clientSecret\r\n}<\/pre>\n
I could also request for specific scopes than just default to whatever is already admin consented to. For that I’ll have to change the scope line like this: https:\/\/graph.microsoft.com\/User.Read<\/code><\/p>\n
Good to remember!<\/p>\n","protected":false},"excerpt":{"rendered":"
When using Client Credentials flow I usually have some PowerShell like this: $authBody = @{ “tenant” = “$tenantId” “client_id” = “$appId” “scope” = “xxxx” “grant_type” = “client_credentials” “client_secret” = $clientSecret } Write-Verbose “Getting Azure AD token” $aadtoken = Invoke-RestMethod -Method POST -Uri “https:\/\/login.microsoftonline.com\/${tenantId}\/oauth2\/v2.0\/token” -Body $authBody -ContentType “application\/x-www-form-urlencoded” $header = @{ “Authorization” = “Bearer ” + … Continue reading Specifying the OAuth2 authentication token scope<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[887],"tags":[1015,227],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/7017"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=7017"}],"version-history":[{"count":1,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/7017\/revisions"}],"predecessor-version":[{"id":7018,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/7017\/revisions\/7018"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=7017"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=7017"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=7017"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}