2

We currently use the following authorize url: https://login.microsoftonline.com/common/oauth2/authorize?resource=https%3A%2F%2Foutlook.office365.com

We want to also use the Graph API, so I added the following: https://login.microsoftonline.com/common/oauth2/authorize?resource=https%3A%2F%2Foutlook.office365.com%2F%26https%3A%2F%2Fgraph.microsoft.com

I've tried different delimiters between the two resources, but couldn't get it to work. Each one resource works separately. I hope that more than 1 resource at a time is supported?

1 Answer 1

3

I think what you're trying to do here by passing multiple values to resource parameter directly will not work (probably not a supported scenario, but I'll wait till someone from Microsoft confirms or I find Azure AD documentation stating exactly that. In the meanwhile, here's an old blog post that says something like this, but it's a blog talking about SSO and old from 2014 :), so don't want to rely solely on this.)

Below I'm explaining how you can make this scenario work by reusing refresh tokens and without passing both resource ids in same call. (NOTE: This approach will work for Authorization Code Grant Flow but not for Implicit grant flow like a JavaScript based SPA, because no refresh token is returned in that case)

  • Once the authorization code is available from authorize endpoint, you go to Azure AD token endpoint requesting token for a single resource (using REST call to endpoint or something like ADAL library AcquireToken method depending on your application requirements)
  • You get back an access token + refresh token as a response to your call to token endpoint. The access token is valid for resource that was mentioned in first call (say graph.microsoft.com)
  • Then using refresh token you just got, you make another call to token endpoint (REST or ADAL AcquireTokenSilent so that there isn't a popup to ask for user credentials this second time) and get a token for the second resource by specifying the 2nd resource id in case of this call
  • The access token you get this time is valid for the 2nd resource.
  • In fact you can continue doing this and hence the name Multi-resource refresh tokens shows up in some places. Although now all refresh tokens are supposed to be multi-resource or valid to be used for requesting any resource that your application has consent for.

Links that can help you in understanding further and implementation

14
  • Thank you @RohitSaigal, this is all great information, but unfortunately we already have a flow, and it wouldn't be easy to change it to request another access token for a 2nd resource, and then to keep track of two different access tokens, and then to know which one to use at which time. If you can find any official information from Microsoft , that would be very helpful. Oct 13, 2018 at 1:42
  • @TanyaKruglikova I understand. I found a blog talking about something vaguely similar but not a Microsoft documentation. Hopefully I just don't know about a way to do this yet and we both will learn something new :) Oct 13, 2018 at 1:48
  • Also, I'm wondering since https ://login.microsoftonline.com/common/oauth2/v2.0/authorize doesn't require a resource, can i try using that? will the token work for both resources? Oct 13, 2018 at 1:58
  • v2.0 endpoint is for Azure AD B2C.. It does support multiple scopes instead of the concept of resource.. but you can only use it if you're planning to move your application to B2C. There are differences between Azure AD (v1) and Azure AD B2C (v2).. learn.microsoft.com/en-us/azure/active-directory/develop/… Oct 13, 2018 at 2:02
  • Rohit thank you, I've read this, but it didn't say explicitly that I can't mix scopes from microsoft graph and outlook.office365.com. I tried 2.0 endpoint, and I can get access to graph, but not outlook.office365.com I read this post: stackoverflow.com/questions/38150335/… and response from @JasonJohnston confirms that you can't mix the scopes. I'm looking for some workaround to use (besides what you've suggested, which requires lots of code changes), either with v1 or v2.0 endpoints. Oct 13, 2018 at 3:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.