Can't Login with Microsoft Account

user_10434913 0
Viewed 1248

I am using The "PHP League oauth2-client" to get details of particular user.

But got error : 

 Array
        (
            [error] => Array
                (
                    [code] => InvalidAuthenticationToken
                    [message] => Access token validation failure. Invalid audience.
                    [innerError] => Array
                        (
                            [request-id] => <reuest-id>
                            [date] => 2019-06-13T07:44:01
                        )

                )

        )

I have passed clientId ,clientSecret , redirectUri ,urlAuthorize , urlAccessToken , urlResourceOwnerDetails and got authorizationUrl . When I hit authorizationUrl , it properly redirect with code ,state,session_state . I just use this code and got accesstoken array. Using accesstoken array , I call 'https://graph.microsoft.com/v1.0/me/'api to fetch user details. But got error i.e Access token validation failure. Invalid audience.

Actually , I am trying login with Microsoft 

$provider = new \League\OAuth2\Client\Provider\GenericProvider([
                'clientId'                => '<cid>',    // The client ID assigned to you by the provider
                'clientSecret'            => '<clientSecret>',   // The client password assigned to you by the provider
                'redirectUri'             => 'https://mywebsideurl',
               'urlAuthorize'            => 'https://login.microsoftonline.com/<tenant_id>/oauth2/authorize',
                'urlAccessToken'          => 'https://login.microsoftonline.com/<tenant_id>/oauth2/token',
                'urlResourceOwnerDetails' => 'https://graph.microsoft.com/v1.0/users/<my-microsoft-mail-id>',

            ]);

             $accessToken = $provider->getAccessToken('authorization_code', [
                        'code' => '<code>'
                    ]);

            $request = $provider->getAuthenticatedRequest(
                        'GET',
                        'https://graph.microsoft.com/v1.0/me/',
                        $accessToken
                    );

Error : 

Array
(
    [error] => Array
        (
            [code] => InvalidAuthenticationToken
            [message] => Access token validation failure. Invalid audience.
            [innerError] => Array
                (
                    [request-id] => <some id>
                    [date] => 2019-06-12T07:36:49
                )

        )

)

I have parse server response :

GuzzleHttp\Psr7\Response Object
        (
            [reasonPhrase:GuzzleHttp\Psr7\Response:private] => Unauthorized
            [statusCode:GuzzleHttp\Psr7\Response:private] => 401
            [headers:GuzzleHttp\Psr7\Response:private] => Array
                (
                    [Content-Type] => Array
                        (
                            [0] => application/json; charset=utf-8
                        )

                    [request-id] => Array
                        (
                            [0] => <rid>
                        )

                    [client-request-id] => Array
                        (
                            [0] => <client-request-id>
                        )

                    [x-ms-ags-diagnostic] => Array
                        (
                            [0] => {"ServerInfo":{"DataCenter":"<some place name here>","Slice":"SliceC","Ring":"<some number>","ScaleUnit":"<something>","RoleInstance":"something","ADSiteName":"something"}}
                        )

                    [WWW-Authenticate] => Array
                        (
                            [0] => Bearer realm="", authorization_uri="https://login.microsoftonline.com/common/oauth2/authorize", client_id="<some id here>"
                        )

                    [Strict-Transport-Security] => Array
                        (
                            [0] => max-age=31536000
                        )

                    [Date] => Array
                        (
                            [0] => Thu, 13 Jun 2019 07:44:01 GMT
                        )

                    [Content-Length] => Array
                        (
                            [0] => <some length>
                        )

                )

            [headerNames:GuzzleHttp\Psr7\Response:private] => Array
                (
                    [content-type] => Content-Type
                    [request-id] => request-id
                    [client-request-id] => client-request-id
                    [x-ms-ags-diagnostic] => x-ms-ags-diagnostic
                    [www-authenticate] => WWW-Authenticate
                    [strict-transport-security] => Strict-Transport-Security
                    [date] => Date
                    [content-length] => Content-Length
                )

            [protocol:GuzzleHttp\Psr7\Response:private] => 1.1
            [stream:GuzzleHttp\Psr7\Response:private] => GuzzleHttp\Psr7\Stream Object
                (
                    [stream:GuzzleHttp\Psr7\Stream:private] => Resource id #<some_id>
                    [size:GuzzleHttp\Psr7\Stream:private] => <some number>
                    [seekable:GuzzleHttp\Psr7\Stream:private] => 1
                    [readable:GuzzleHttp\Psr7\Stream:private] => 1
                    [writable:GuzzleHttp\Psr7\Stream:private] => 1
                    [uri:GuzzleHttp\Psr7\Stream:private] => php://temp
                    [customMetadata:GuzzleHttp\Psr7\Stream:private] => Array
                        (
                        )

                )

        )

As per my observation server return WWW-Authenticate url is wrong , it should be https://login.microsoftonline.com/tenant_id/oauth2/authorize .

Is there any way to config WWW-Authenticate url from azure back-end ??

azure-ad-graph-api azure php
1 Answers

The configuration for the provider is not correct. To allow Microsoft account login, you should use Microsoft identity platform v2.0 endpoint. When you register your application on Azure portal, remember to set Supported account types to Accounts in any organizational directory and personal Microsoft accounts.

Here is a sample for your reference. 

$oauthClient = new \League\OAuth2\Client\Provider\GenericProvider([
      'clientId'                => env('OAUTH_APP_ID'),
      'clientSecret'            => env('OAUTH_APP_PASSWORD'),
      'redirectUri'             => env('OAUTH_REDIRECT_URI'),
      'urlAuthorize'            => env('OAUTH_AUTHORITY').env('OAUTH_AUTHORIZE_ENDPOINT'),
      'urlAccessToken'          => env('OAUTH_AUTHORITY').env('OAUTH_TOKEN_ENDPOINT'),
      'urlResourceOwnerDetails' => '',
      'scopes'                  => env('OAUTH_SCOPES')
    ]);

OAUTH_APP_ID=YOUR_APP_ID_HERE
OAUTH_APP_PASSWORD=YOUR_APP_PASSWORD_HERE
OAUTH_REDIRECT_URI=http://localhost:8000/authorize
OAUTH_SCOPES='openid profile offline_access User.Read Mail.Read'
OAUTH_AUTHORITY=https://login.microsoftonline.com/common
OAUTH_AUTHORIZE_ENDPOINT=/oauth2/v2.0/authorize
OAUTH_TOKEN_ENDPOINT=/oauth2/v2.0/token
user_105049990
Related