Microsoft Azure - OAuth2 - "invalid_request"

user_10101797 0
Viewed 11443

I would like to connect my app with Microsoft Graph. I created my web-app in Azure (I have my client_id and client_secret). I am able to send a request to get the authorization code from https://login.microsoftonline.com/common/oauth2/v2.0/authorize.

The problem is that when I send a POST request in order to get the acess token from https://login.microsoftonline.com/common/oauth2/v2.0/token (exactly like said here in the "Using permissions" section) using Postman (with form-data option), I get an "AADSTS9000410: Malformed JSON" error:

{
  "error": "invalid_request",
  "error_description": "AADSTS9000410: Malformed JSON.\r\nTrace ID: f5c1dd4b-ad43-4265-91cb-1b7392360301\r\nCorrelation ID: 1dea54ed-bb43-4951-bc9e-001877fe427b\r\nTimestamp: 2019-01-14 21:38:42Z",
  "error_codes": [9000410],
  "timestamp": "2019-01-14 21:38:42Z",
  "trace_id": "f5c1dd4b-ad43-4265-91cb-1b7392360401",
  "correlation_id": "1dea54ed-bb43-4951-bc9e-001878fe427b"
}

Moreover, when I send the same request with a raw option in Postman, I get "AADSTS900144: The request body must contain the following parameter: 'grant_type'":

 {
  "error": "invalid_request",
  "error_description": "AADSTS900144: The request body must contain the following parameter: 'grant_type'.\r\nTrace ID:a7c2f8f4-1510-42e6-b15e-b0df0865ff00\r\nCorrelation ID:e863cfa9-0bce-473c-bdf6-e48cfe2356e4\r\nTimestamp: 2019-01-1421:51:29Z",
  "error_codes": [900144],
  "timestamp": "2019-01-14 21:51:29Z",
  "trace_id": "a7c2f8f4-1510-42e6-b15e-b0df0865ff10",
  "correlation_id": "e863cfa9-0bce-473c-bdf6-e48cfe2356e3"
}

However, when I remove application/json in my header in Postman, and I put x-www-form-urlencoded option, everything looks fine.

I can only send POST requests with a JSON format in my application.

Does Microsoft Graph support JSON format for POST requests?

Is it a Postman issue?

microsoft-graph-api azure-active-directory postman
2 Answers

I ran into a similar issue, but realized that there was a mismatch between the Content-Type: application/x-www-form-urlencoded header and the JSON-formatted request body. If you refer to this documentation, you'll see that the request body needs to be URL encoded (concatenated with ampersands, encoded entities, etc.), which ultimately resolved my issue. So, I don't believe this is an issue with Postman or MS APIs but, rather, just incorrect formatting of your request body.

I'm not sure what language your app uses, but here's an example using Node and Express that works for me:

const fetch = require('node-fetch')
const { URLSearchParams } = require('url')

async function getAccessToken(req, res, next) {
  try {
    const response = await fetch('https://login.microsoftonline.com/common/oauth2/v2.0/token', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/x-www-form-urlencoded'
      },
      // Previously I was doing `body: JSON.stringify({...})`, but
      // JSON !== URL encoded. Using `URLSearchParams` (or whatever
      // the equivalent is in your language) is the key to success.
      body: new URLSearchParams({
        client_id: YOUR_CLIENT_ID_HERE,
        scope: 'User.Read Calendars.Read',
        redirect_uri: YOUR_REDIRECT_URL_HERE,
        grant_type: 'authorization_code',
        client_secret: YOUR_CLIENT_SECRET_HERE,
        code: req.query.code
      }
    })
    const json = await response.json()
    // `json` will have `access_token` and other properties
  } catch (err) {
    throw err
  }
}

Hope that helps!

user_9922850

It is neither a Microsoft nor a Postman issue, it is simply how OAuth defines the token workflow. This is defined in RFC 6749 - Section 4.1.3:

The client makes a request to the token endpoint by sending the following parameters using the application/x-www-form-urlencoded format per Appendix B with a character encoding of UTF-8 in the HTTP request entity-body

user_1055180
Related