Assistance Required for Azure Bing Spell Check API Integration

Question

Assistance Required for Azure Bing Spell Check API Integration

Shivaji Shitole 105

Hi All,

We are developing an application that utilizes the Azure Bing Spell Check API for text correction. The Bing API is accessed using an access token, which is generated using a Kubernetes service token. Below are the steps we have followed:

Federated Identity Credential: A new app registration was created, and the federated identity credential was configured with the necessary issuer and subject values to establish a trust relationship between the Kubernetes service account and Azure AD.

Bing Search Service: An Azure Bing Search service was created, and IAM was configured with the reader role for the app ID created in the previous step.

Kubernetes Token: The service account token is read from the cluster path: /var/run/secrets/eks.amazonaws.com/serviceaccount.

Access Token: The access token is generated using the service account token with the following details:

URL: https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token
- Method: POST
  - Body Parameters: grant_type=client_credentials&client_id={client-id}&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&scope=https://api.bing.microsoft.com/.default&client_assertion={service-account-token}
    - The access token is generated with the audience set to https://api.bing.microsoft.com/.
    Bing API Call: The API is called by passing the access token as a bearer token in the authentication header:
```
- **Spell Check URL**: `https://api.bing.microsoft.com/v7.0/spellcheck?text=sample%20check&mode=spell&mkt=en-US`

   - **Method Type**: GET
```

Exception: When calling the Bing API, we encounter the following error:

Unauthorized. Access token is missing, invalid, audience is incorrect (https://bing.azure.com), or has expired.

If we attempt to add the scope or audience as https://bing.azure.com, we receive a different error: AADSTS500011: The resource principal named https://bing.azure.com was not found in the tenant named XXX Group. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant.

We need assistance in understanding what is missing in our configuration. Please provide the correct steps and configuration to implement this functionality.

Thanks in advance.

Anonymous

2025-02-19T13:19:26.5533333+00:00
Hi @Shivaji Shitole,

Your issue appears to be related to an incorrect audience (resource ID) in the OAuth token request, leading to the AADSTS500011 error. The provided information correctly explains that this error occurs when the requested service principal (resource ID) does not exist in your Azure tenant. To troubleshoot, you should:

Ensure that the audience (resource) in your OAuth token request is correctly set to https://api.bing.microsoft.com/, as Bing Spell Check API requires this value. Using https://bing.azure.com/ is incorrect and will cause the error.

Check the Service Principal: Go to Azure AD > Enterprise Applications and search for the app using the client ID. If it doesn’t exist, you may need to register the application correctly.

Grant Admin Consent: Navigate to Azure AD > App Registrations, select your app, and ensure the Bing Search API permissions are granted and admin consent is provided.

Validate the Federated Identity Configuration: Ensure your Kubernetes service account is correctly mapped in Azure AD with the right issuer and subject values.

Confirm the Token Request Format: When requesting the access token, verify that:

The client_assertion contains the correct JWT assertion from Kubernetes.

The IAM role assigned to the Bing Search resource is Cognitive Services User rather than Reader, as Reader does not grant API access.

For further guidance, refer to the following resources:

Tutorial: Getting Spell Check Results using Bing Spell Check API

API authentication and authorization - Overview

If the issue persists, check Azure AD logs for authentication failures.

Thank you.
Shivaji Shitole 105 Reputation points

2025-02-20T12:22:26.02+00:00

HI @Anonymous ,

Thanks for your response.

I was following the Microsoft documentation on Azure Bing spell check API, this says that Ocp-Apim-Subscription-Key is mandatory to call spell check API. Does this mean, AD authentication is not supported for Spell check API?
Shivaji Shitole 105 Reputation points

2025-02-21T16:25:58.6133333+00:00

Thanks @Anonymous for the detailed explanation. This helps.
Anonymous

2025-02-21T16:53:48.5733333+00:00

Hi @Shivaji Shitole,

I'm glad to hear that my response was helpful to you. And thanks for sharing the feedback, which might be beneficial to other community members reading this thread as solution. Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", so I'll convert the previous response to an answer in case you'd like to accept the answer. This will help other users who may have a similar query find the solution more easily. If you have any further questions or concerns, please don't hesitate to ask. We're always here to help.

1 answer

Your answer

Anonymous

2025-02-19T13:19:26.5533333+00:00

Hi @Shivaji Shitole,

Your issue appears to be related to an incorrect audience (resource ID) in the OAuth token request, leading to the AADSTS500011 error. The provided information correctly explains that this error occurs when the requested service principal (resource ID) does not exist in your Azure tenant. To troubleshoot, you should:

Ensure that the audience (resource) in your OAuth token request is correctly set to https://api.bing.microsoft.com/, as Bing Spell Check API requires this value. Using https://bing.azure.com/ is incorrect and will cause the error.

Check the Service Principal: Go to Azure AD > Enterprise Applications and search for the app using the client ID. If it doesn’t exist, you may need to register the application correctly.

Grant Admin Consent: Navigate to Azure AD > App Registrations, select your app, and ensure the Bing Search API permissions are granted and admin consent is provided.

Validate the Federated Identity Configuration: Ensure your Kubernetes service account is correctly mapped in Azure AD with the right issuer and subject values.

Confirm the Token Request Format: When requesting the access token, verify that:

The client_assertion contains the correct JWT assertion from Kubernetes.

The IAM role assigned to the Bing Search resource is Cognitive Services User rather than Reader, as Reader does not grant API access.

For further guidance, refer to the following resources:

Tutorial: Getting Spell Check Results using Bing Spell Check API

API authentication and authorization - Overview

If the issue persists, check Azure AD logs for authentication failures.

Thank you.
Shivaji Shitole 105 Reputation points

2025-02-20T12:22:26.02+00:00

HI @Anonymous ,

Thanks for your response.

I was following the Microsoft documentation on Azure Bing spell check API, this says that Ocp-Apim-Subscription-Key is mandatory to call spell check API. Does this mean, AD authentication is not supported for Spell check API?
Shivaji Shitole 105 Reputation points

2025-02-21T16:25:58.6133333+00:00

Thanks @Anonymous for the detailed explanation. This helps.
Anonymous

2025-02-21T16:53:48.5733333+00:00

Hi @Shivaji Shitole,

I'm glad to hear that my response was helpful to you. And thanks for sharing the feedback, which might be beneficial to other community members reading this thread as solution. Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", so I'll convert the previous response to an answer in case you'd like to accept the answer. This will help other users who may have a similar query find the solution more easily. If you have any further questions or concerns, please don't hesitate to ask. We're always here to help.

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more