0

I have created a WCF service that has CRUD operations to Outlook using Graph API. it is working in my local but when I deployed it in our UAT server I get a 403 forbidden in this part:

result = _authContext.AcquireTokenAsync(resourceId,ClientId, uc).Result;

this is a snippet of my AD auth code:

  string authority = string.Format(CultureInfo.InvariantCulture, Instance, Tenant);
    if(_authContext == null)
    {
          _authContext = new AuthenticationContext(authority, false, new FileCache(_cacheFile));
    }
string resourceId = path to resource id;

try { 
  result = _authContext.AcquireTokenSilentAsync(resourceId,ClientId).Result;
  accessToken = result.AccessToken;
  expiresOn = result.ExpiresOn;

} catch( AggregateException exc) 
{
  if(ex != null && ex.ErrorCode != "failed_to_acquire_token_silently")
  {
    throw;
  }
}

if(accessToken == null || expiresOn <= DateTimeOffset.UtcNow.AddMinutes(5)) 
{
  UserCredential uc = new UserCredential();
  uc = new UserCredential("hardcoded username for testing");
  result = _authContext.AcquireTokenAsync(resourceId,ClientId, uc).Result;
  accessToken = result.AccessToken;
  expiresOn = result.ExpiresOn;
}

I have tried hardcoding the UserCredential already and the app pool account in the IIS has the permission.

in my web.config, i added this:

<system.net>
  <defaultProxy useDefaultCredentials="true">
      <proxy bypassonlocal="True" proxyaddress="......" />
  </defaultProxy>
</system.net>

i have also tried setting up a WebProxy in the App Start method of my Glabal.asax but it did not help.Is it a problem with the code or a config issue in the IIS?

7
  • From my standpoint, Http 403 typically indicates that the client has no permission to access the server and the service received the request and deny providing service. Such as there is something wrong with SSL configuration and access. Jul 4, 2019 at 6:20
  • Besides, how does the WCF service authenticate the client? I would like to know the configuration of the server. Have you enabled the corresponding authentication mode in IIS authentication module? I don’t know much about the UAT server, is it an http proxy? Asp.net Core calls the service by using web proxy is not implemented at present. github.com/dotnet/wcf/issues/1592 Jul 4, 2019 at 6:21
  • hi abraham, it's an http proxy. is it related to the app pool used? if i remove the proxy part from the web config i get the "cannot resolve login.microsoftonline.com" error.
    – Page F.P.T
    Jul 4, 2019 at 8:43
  • About the app pool, do you mean that the ApplicationpoolIdentity should be changed? I have no idea. Will it fail if we call the service without using the http proxy? Have you provided the credentials the server required? It seems that the client needs to be authenticated by the server. What is the authentication mode of the server? I would like to know the System.ServiceModel section of the configuration. Jul 4, 2019 at 9:55
  • if we call the AcquireTokenAsync method without the http procy, it will fail with unable to resolve error . what credentials would i provide, the authentication gets the identity of the current user and uses it to authenticate using the resource and client id. as for the service behavior http get enabled is set to true.
    – Page F.P.T
    Jul 4, 2019 at 10:20

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.