omniauth: (microsoft_graph_auth) Authentication failure! invalid_credentials: OAuth2::Error

Question

I followed the tutorial https://docs.microsoft.com/en-us/graph/tutorials/ruby to integrate Azure B2C with rails app. I am able to enter azure b2c user account credentails, able to get 2 factor code working but unfortunately its failing while redirect to the app. Its failing in the callback method in omniauth strategies.

microsoft_graph_auth.rb

# Copyright (c) Microsoft Corporation.
# Licensed under the MIT License.

# 
require 'omniauth-oauth2'

module OmniAuth
  module Strategies
    # Implements an OmniAuth strategy to get a Microsoft Graph
    # compatible token from Azure AD
    class MicrosoftGraphAuth < OmniAuth::Strategies::OAuth2
      option :name, :microsoft_graph_auth

      DEFAULT_SCOPE = 'openid'.freeze

      # Configure the Microsoft identity platform endpoints
      option :client_options,
              site: 'https://login.microsoftonline.com',
              authorize_url: '/common/oauth2/v2.0/authorize',
              token_url: '/common/oauth2/v2.0/token'

      # Send the scope parameter during authorize
      option :authorize_options, [:scope]

      # Unique ID for the user is the id field
      uid { raw_info['id'] }

      # Get additional information after token is retrieved
      extra do
        {
          'raw_info' => raw_info
        }
      end

      def raw_info
        # Get user profile information from the /me endpoint
        @raw_info ||= access_token.get('https://graph.microsoft.com/v1.0/me').parsed
      end

      def authorize_params
        super.tap do |params|
          puts "veda, params",request.params['scope']
          params['scope'.to_sym] = request.params['scope'] if request.params['scope']
          params[:scope] ||= DEFAULT_SCOPE

         
        end
      end

      # Override callback URL
      # OmniAuth by default passes the entire URL of the callback, including
      # query parameters. Azure fails validation because that doesn't match the
      # registered callback.
      def callback_url
        options[:redirect_uri] || (full_host + script_name + callback_path)
      end
    end
  end
end
#

omniauth_graph.rb

require 'microsoft_graph_auth'

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :microsoft_graph_auth,
           ENV['AZURE_APP_ID'],
           ENV['AZURE_APP_SECRET'],
           scope: ENV['AZURE_SCOPES']
          #  :provider_ignores_state => true
end

Error:

http://localhost:3000/auth/microsoft_graph_auth/callback?state=f4dc76cefbf6d93aab1ef28dede871b23eadc61a4df85d9c&code=eyJraWQiOiJjcGltY29yZV8wOTI1MjAxNSIsInZlciI6IjEuMCIsInppcCI6IkRlZmxhdGUiLCJzZXIiOiIxLjAifQ..3uVicJVRjgO-i6NO.tiunM4yb7wJhT_5xBNUGhSyRPLvkFYhfUavo6fa3CntlC_jkFbSlbQ6ulO-g7hCkUykch98FcM-RDoV3SsDgEDzTgxmFROumJjjqG-lWuA1hL8S4i_fR3CDD50X9CJJFQV8cidd8u_cdetEJ2_Wh7TmoTF7FVF7T9u_1Bk-VHepZPNc9Xu05iKosHYsKZuahizuhD1RdUXQuVz4QTii8_f1MNBG4VNrOJK-7iL62qEWFR6DHcopkN9IaU2-w74U97UBN7rvk0b-HnZhm1QYAhIp-Rr8rLyCWNlUlwCEBJ2Z-19Deu0WN0kwitxWmJsFUXJHLEKXde0H8yNDfMrw3tM3T_45kEi99innuhaowBSwYwN5ZhySSvmX5A0ToW11F7WJxBMSQDoaGpz1JvKNGf_5CrHReN6BBVME2qFxoJ527fBqrZOozupmruSz_vU0zu8wLxl59vgHGHq_tyH_L6tcoFoBv9EUbW9ndQCWy3ibvetJJ4UBAuG9VwJOiRxxTn9IA2IMuIapbKYfdpnATWwu_gCIRV5d-SoNVT7KbIG8CRF_W58TadLc4t0JuXiq4e2khQQ.gBxfKD8jtGZicYfMTazXKQ


OAuth2::Error 

{"id_token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ilg1ZVhrNHh5b2pORnVtMWtsMll0djhkbE5QNC1jNTdkTzZRR1RWQndhTmsifQ.eyJleHAiOjE2MDYxOTU1NDEsIm5iZiI6MTYwNjE5MTk0MSwidmVyIjoiMS4wIiwiaXNzIjoiaHR0cHM6Ly9pbmZseXR4cGQuYjJjbG9naW4uY29tL2I3ZDNhZTc4LTA4NjItNGJlYS05ZmYxLWZmMWI1MDM1MmJjNi92Mi4wLyIsInN1YiI6IjI3ZmQ5MTkxLTAwOWEtNDMzZi1hN2ZmLTZmNjVkM2ZlNDk5ZCIsImF1ZCI6ImM3ZGZkZDBiLTE1NDAtNDE3ZS1iNTdlLWZhMjRjNDIxOGM0MyIsImlhdCI6MTYwNjE5MTk0MSwiYXV0aF90aW1lIjoxNjA2MTkxOTQwLCJvaWQiOiIyN2ZkOTE5MS0wMDlhLTQzM2YtYTdmZi02ZjY1ZDNmZTQ5OWQiLCJuYW1lIjoiVmVkYS5SYW1haWFoQGx0dHMuY29tIiwiZW1haWxzIjpbIlZlZGEuUmFtYWlhaEBsdHRzLmNvbSJdLCJ0ZnAiOiJCMkNfMV9TSUdOX0lOIn0.o04QC811sXkRFHIgUEbW5CrH4ed4t2bKjqWc8koENY6xyb3JHzde2NAMOQoKJ2S-jRT91AIczLJQW1gB7RXqcqyX5wQRpbSxGIXPAr1hvXQ9W1zdwvkDVM9U99NIGREviHnuRJXLOXjxyWtglIldYjPyGPidhZpoc6cNpuYdZGb-ISGZmS8W-7fKzjMHS6okg_IB--nuVISXbEEzlU782tMFyySq9eh8bnrzc8ZRUaeZk3dJqsFPB1tVT74CZ65GBkBFAzefU1wz_1P8L6ZkhNLRl42WhWeUJFgtSKGRNtiF5cRMnlE6PCIoCXsVUMEG_BFVoHSHW6kmyjfIXSXbOw","token_type":"Bearer","not_before":1606191941,"id_token_expires_in":3600,"profile_info":"eyJ2ZXIiOiIxLjAiLCJ0aWQiOiJiN2QzYWU3OC0wODYyLTRiZWEtOWZmMS1mZjFiNTAzNTJiYzYiLCJzdWIiOm51bGwsIm5hbWUiOiJWZWRhLlJhbWFpYWhAbHR0cy5jb20iLCJwcmVmZXJyZWRfdXNlcm5hbWUiOm51bGwsImlkcCI6bnVsbH0","scope":"offline_access openid","refresh_token":"eyJraWQiOiJjcGltY29yZV8wOTI1MjAxNSIsInZlciI6IjEuMCIsInppcCI6IkRlZmxhdGUiLCJzZXIiOiIxLjAifQ..Brt-lzu9a5LTUUFw.fpKmOJFKfWu77gnmDx4dH0fUv0fCRL__60BKfYjXFPT3u2bR7BjMcy_1Gi7S_3NVUFN7tFR92S9soFdGpyPFYXAZAWd-K_3NUJ_YCkFcoOlRJVsyr-sLHy7DYYAzqpPyaC5dOQ9H7WSkPRmfmXZjCZxMTrGFJvPVDxEkLfd600i9i578DdogmO-4704gm0aI3qAPHqxzRQex1A8Y1ZxsWwNlySd0rBnVHpnMtPC1ZMbxnYpit86sRRQN5iHcvWQ7VizvzzTem9VGJyechH5tIeZv2waGjFkpRnY65XT84uJMm1a-Z6ugqkT33O7CC1RqEnq_xhnB8szauqBBEV6h5PD1qadrLvghep4hZPMQoVwEyK19Ajq6g96RCrncPkMFuO4bKQrLmsbzSp46p-vlX6kRgb0cAbl8Mc8BWty4vF9zJ8ZUqdKiJ20-9W7Q3pUMW0lah2fehE37gIe2gxKm2_Sncc3emduidCQhRVvbJGqHCVYKGqHhxwOTqsWsYE2EGxopi0H2oii1RD0c91I9firvvw47kvEmAdTIU5hz9_54Lcqz4OuieWF6Oi8Qvj7J-54zuQ.u4R_4EhbDLqGWLtGwx-vUw","refresh_token_expires_in":1209600} 

Application Trace | Framework Trace | Full Trace
oauth2 (1.4.4) lib/oauth2/client.rb:150:in `get_token'
oauth2 (1.4.4) lib/oauth2/strategy/auth_code.rb:30:in `get_token'
omniauth-oauth2 (1.7.0) lib/omniauth/strategies/oauth2.rb:126:in `build_access_token'
omniauth-oauth2 (1.7.0) lib/omniauth/strategies/oauth2.rb:91:in `callback_phase'
omniauth (1.9.1) lib/omniauth/strategy.rb:238:in `callback_call'
omniauth (1.9.1) lib/omniauth/strategy.rb:189:in `call!'
omniauth (1.9.1) lib/omniauth/strategy.rb:169:in `call'
omniauth (1.9.1) lib/omniauth/builder.rb:45:in `call'
rack (2.2.2) lib/rack/tempfile_reaper.rb:15:in `call'
rack (2.2.2) lib/rack/etag.rb:27:in `call'
rack (2.2.2) lib/rack/conditional_get.rb:27:in `call'
rack (2.2.2) lib/rack/head.rb:12:in `call'
actionpack (6.0.2.2) lib/action_dispatch/http/content_security_policy.rb:18:in `call'
rack (2.2.2) lib/rack/session/abstract/id.rb:266:in `context'
rack (2.2.2) lib/rack/session/abstract/id.rb:260:in `call'
actionpack (6.0.2.2) lib/action_dispatch/middleware/cookies.rb:648:in `call'
activerecord (6.0.2.2) lib/active_record/migration.rb:567:in `call'
actionpack (6.0.2.2) lib/action_dispatch/middleware/callbacks.rb:27:in `block in call'
activesupport (6.0.2.2) lib/active_support/callbacks.rb:101:in `run_callbacks'
actionpack (6.0.2.2) lib/action_dispatch/middleware/callbacks.rb:26:in `call'
actionpack (6.0.2.2) lib/action_dispatch/middleware/executor.rb:14:in `call'
actionpack (6.0.2.2) lib/action_dispatch/middleware/actionable_exceptions.rb:17:in `call'

Console:

[2020-11-23T23:20:23.472229 #8624]  INFO -- omniauth: (microsoft_graph_auth) Callback phase initiated.
E, [2020-11-23T23:20:24.336261 #8624] ERROR -- omniauth: (microsoft_graph_auth) Authentication failure! invalid_credentials: OAuth2::Error,

I googled a lot but I could not find anything useful, Can someone tell me how to resolve this isuue? Any hep is much appreciated.

omniauth: (microsoft_graph_auth) Authentication failure! invalid_credentials: OAuth2::Error

0 Answers