Obo token flow

Question

Obo token flow

Francesco Bruni 20

Dears,

I got an issue.

I got an application that use oAuth2 code flow to get user groups. In order to retrieve this data, I use MS graph scopes.
I'd like using this token to get another token for a custom api of another application.

The other application exposes an API that gets authorized on the first one and granted by admins.

In order to get the second token, I'm testing the OBO: I use the client/secret of the first app, with the token retrieved in the first call and set the scope of the custom api.

But assertion fails and the second token cannot be retrieved.
If I pass the custom scope API in the first call, everything works. It's supposed to work this way?

best,

FB

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Anonymous

2024-10-30T23:58:42.67+00:00

Hi @Francesco Bruni , did you need any more help with this question? If not could you please mark "Accept Answer" on the appropriate answer so other users can reference it?

Thank you,

James

Answer accepted by question author

Anonymous

Hi @Francesco Bruni , the OBO flow is used when a middle-tier web API needs to call another web API on behalf of the user as follows:

The user signs in to the client application and obtains an access token.
The client application sends the access token to the middle-tier web API.
The middle-tier web API uses the access token to request a new access token from Azure AD for the downstream web API.
Azure AD validates the access token and issues a new access token for the downstream web API.

It looks like you are skipping step 2 and using the access token obtained by the client application to request a new access token for the downstream web API. This won't work because the access token obtained by the client application is not a valid token for the downstream API.

You need to pass the access token obtained by the client application to the middle-tier web API and use it to request a new access token for the downstream web API. The new access token will be valid for the downstream web API because it was obtained on behalf of the user.

You also need to make sure that the access token obtained by the client application has the necessary scopes to call the middle-tier web API and that the new access token requested has the necessary scopes to call the downstream API.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James

Francesco Bruni 20 Reputation points

2024-08-02T04:23:26.6366667+00:00

Thanks for getting me back.

In facts point 2 is the issue: if I use the token retrieved for the client to get a new token for the my custom api, validation fails, since the token release for the client has the Graph API as scope.

Instead I’d like to get a token valid for graph since I need to retrive user groups as well as my custom api.

It seems that asking token for scope se belonging to multiple application at the same time is not possibile. How ca I overcome the issue?

I cannot trivially perform two token requests, since I use the code flow.

and I tried to get the first token using my custom API as scope and using a client credentials to get user groups, but I got an “insufficient permission” error.

is this expected?

best

1 additional answer

Anonymous

2024-10-30T23:58:42.67+00:00

Hi @Francesco Bruni , did you need any more help with this question? If not could you please mark "Accept Answer" on the appropriate answer so other users can reference it?

Thank you,

James
Francesco Bruni 20 Reputation points

2024-08-02T04:23:26.6366667+00:00

Thanks for getting me back.

In facts point 2 is the issue: if I use the token retrieved for the client to get a new token for the my custom api, validation fails, since the token release for the client has the Graph API as scope.

Instead I’d like to get a token valid for graph since I need to retrive user groups as well as my custom api.

It seems that asking token for scope se belonging to multiple application at the same time is not possibile. How ca I overcome the issue?

I cannot trivially perform two token requests, since I use the code flow.

and I tried to get the first token using my custom API as scope and using a client credentials to get user groups, but I got an “insufficient permission” error.

is this expected?

best

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more