5

Goal

I want to authenticate my daemon application with a certificate instead of client secret against Microsoft Graph & want understand the exact request necessary to successfully authenticate.

Using the following resources:

Could there be an error in the Azure AD configuration of your app?

All Azure AD configurations were tested prior with a client-secret. The certificate public key was also uploaded beforehand: enter image description here

Request & Problem

I managed to create this request (tenant-id, client-id, certificates are just dummies)

Values:

grant_type: urn:ietf:params:oauth:client-assertion-type:jwt-bearer
client_assertion_type: logon_cert
client_id: my-client-id-from-azure
scope: https://graph.microsoft.com/.default
client_assertion: JWT containing

  • Header: (x5t contains the base64 encoded certificate sha1 thumbprint from the uploaded certificate, see above picture)

    {
  "typ": "JWT",
  "x5t": "QUY4RjBERERGMDBBOURGRUQ0MzkzODRGQTYzMjhFQ0FBRDNBOEUzNw",
  "alg": "RS256"
}

  • Payload:

    {
  "iss": "my-client-id-from-azure",
  "sub": "my-client-id-from-azure",
  "scope": "https://graph.microsoft.com/.default",
  "aud": "https://login.microsoftonline.com/my-tenant-id/oauth2/v2.0/token",
  "iat": 1625591612,
  "nbf": 1625591612,
  "exp": 1625595212,
  "jti": "some-dynamically-generated-uuid"
}
Request:
POST https://login.microsoftonline.com/my-tenant-id/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer&client_assertion=eyJ0eXAiOiJKV1QiLCJ4NXQiOiJSRFUwTUVRd016RkdOakpGTUVOQk5UaEVPVFpGTXpBNFFrRkZNMFUzTmpFd01USkVPRFUwUWc9PSIsImFsZyI6IlJTMjU2In0.eyJpc3MiOiJteS1jbGllbnQtaWQtZnJvbS1henVyZSIsInNjb3BlIjoiaHR0cHM6Ly9ncmFwaC5taWNyb3NvZnQuY29tLy5kZWZhdWx0IiwiYXVkIjoiaHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL215LXRlbmFudC1pZC9vYXV0aDIvdjIuMC90b2tlbiIsImlhdCI6MTYyNTY2MDU3MywibmJmIjoxNjI1NjYwNTczLCJzdWIiOiJteS1jbGllbnQtaWQtZnJvbS1henVyZSIsImp0aSI6IjlhZTQwYTk2LTliMTgtNDRhOS1hOWM3LWE3NDZjMjA4OGUxMyIsImV4cCI6MTYyNTY2NDE3M30.pw81FeQirjIsnXGlLSLDG5Cz4rIdOuF54M8fPmDlubNs0-DoHpkj9OdrCXlCPDWvQLaYAs3mH9kcSP-Z4rf-NgaiCF-ECL-iA2xxvQ3n8JSDeaPPkLd6tMAKeMm5sEIcap7RJ8Fnt1kCflVAOIuYCh_zijJd9etQj-2wfbtiHnHtlpg6n0-4u7oj9wAx2naIU6J4dtgdIPypBTfwxyXtZWy0nkM8jde6Jr7CqVVlECdf7wyGwN1Jhwf6PeihKn8peQKaXzVnMmLpcCmjNENnTRM5PmhEQkCGOOR4hMJkdfCONWmOtSoRlndhCQypBQM-fzl_-sDviXNjAYKvrYTUM-kwZZBqKyzdekqMnxxwnaKmF1uGVnrSjad_AfW0A9Vg9UpaqGvsbe8Doq15I7KE46kzd4y3fDoibDQG-qaYL8LYKcrVUDkTw_PNfiyihlcaGjBvHVaMBsYhJJlNnohktO0OES0WO0iUlj_M0PuOF7JxYsPAQZM5uZGPTRCQhen_8khQ8z70C2YYz965kCROL9-WC53Ezbt1R0QjHR4UupV3CtQfZe_BkTG8vYu7SMWbxDEGZKb6cRsTCgzqmd6l3f6OGojQA_EAvFJpL0kw0d_tfYnY4ZkyLdcI3G3fMyhicm7qmkiq7ZRdnGL2uCl-tpxsoLD7UbvVPD3CS_LNAp4&client_id=my-client-id-from-azure&scope=https%3A%2F%2Fgraph.microsoft.com%2F.default&grant_type=client_credentials
Response:

I'm expecting an access token, instead, I get a 401 Unauthorized stating

{
  "error": "invalid_client",
  "error_description": "AADSTS700027: Client assertion contains an invalid signature. [Reason - The key was not found., Thumbprint of key used by client: 'some-other-thumbprint', Please visit the Azure Portal, Graph Explorer or directly use MS Graph to see configured keys for app Id 'my-app-id'. Review the documentation at https://learn.microsoft.com/en-us/graph/deployments to determine the corresponding service endpoint and https://learn.microsoft.com/en-us/graph/api/application-get?view=graph-rest-1.0&tabs=http to build a query request URL, such as 'https://graph.microsoft.com/beta/applications/my-app-id']\r\nTrace ID: some-uuid\r\nCorrelation ID: some-other-uuid\r\nTimestamp: 2021-07-07 12:25:46Z",
  "error_codes": [
    700027
  ],
  "timestamp": "2021-07-06 12:25:46Z",
  "trace_id": "some-uuid",
  "correlation_id": "some-other-uuid",
  "error_uri": "https://login.microsoftonline.com/error?code=700027"
}

I'm lost as to what the issue could be.

Question:

What am I doing wrong?

Theo
  • 2,262
  • 3
  • 23
  • 49
  • 1
    Based on the error your getting it looks like your trying to use the On Behalf of flow ? eg https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-on-behalf-of-flow so your requested_token_use should be on_behalf_of (which is why you getting the error) but it also looks like you also missing the client_assertion. If that's not the case you maybe wanting to use the Client Credentials flow https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow – Glen Scales Jul 07 '21 at 00:06

2 Answers2

3

So the issue came from the way the x5t header was being created.

I misunderstood the docs that clearly state the fingerprint as being a hex before encoding it base64: screenshot from the docs

With a fingerprint like this 204C837E10143C1428D7911CB60ED0075C3E1062, the string needs to be treated as a HEX binary, not as a simple string.

Example (PHP):

PHPSandbox Notebook

Pseudo code:

// load certificate
certificate = load_file('/path/to/cert.pem')
// fingerprint is hex string 204C837E10143C1428D7911CB60ED0075C3E1062
certificate_fingerprint_hex_string = x509fingerprint($certificate)

// hexademical string is being converted to binary format
certificate_fingerprint_binary = hex_to_binary(certificate_fingerprint_hex_string)

// binary format gets base64 encoded (not base64url) to IEyDfhAUPBQo15Ectg7QB1w+EGI=
x5t = base64_encode(certificate_fingerprint_binary)

Request (Documentation)

Run in Postman

Method and headers

POST https://login.microsoftonline.com/my-tenant-id/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Body (not yet formatted according to Content-Type)

  • client_id: my-client-id-from-azure
  • client_assertion_type: urn:ietf:params:oauth:client-assertion-type:jwt- bearer
  • client_assertion: see below a JWT click here for details
  • grant_type: client_credentials
  • scope: https://graph.microsoft.com/.default

client_assertion

  • Header: (x5t contains the base64 encoded certificate sha1 thumbprint from the uploaded certificate, see above picture)

    {
  "typ": "JWT",
  "x5t": "IEyDfhAUPBQo15Ectg7QB1w+EGI=",
  "alg": "RS256"
}

  • Payload:

    {
  "iss": "my-client-id-from-azure",
  "sub": "my-client-id-from-azure",
  "scope": "https://graph.microsoft.com/.default",
  "aud": "https://login.microsoftonline.com/my-tenant-id/oauth2/v2.0/token",
  "iat": 1625591612,
  "nbf": 1625591612,
  "exp": 1625595212,
  "jti": "some-dynamically-generated-uuid"
}
Theo
  • 2,262
  • 3
  • 23
  • 49
1

Based on some search, here how I create the JWT token to request accessToken:

package required

composer required firebase/php-jwt ramsey/uuid guzzlehttp/guzzle

php code

<?php
use Firebase\JWT\JWT;
use Ramsey\Uuid\Uuid;

require_once (__DIR__.'/vendor/autoload.php');

$guzzle = new \GuzzleHttp\Client();
$authTenant = '';
$clientID = '';
$certPubFile = '';
$certPrivFile = '';

$url = 'https://login.microsoftonline.com/' . $authTenant . '/oauth2/v2.0/token';

$cert = openssl_x509_read(file_get_contents($certPubFile));
$sha1_hash = openssl_x509_fingerprint($cert); // sha1 hash (x5t parameter)
$jwt =  JWT::encode([
    'aud' => 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
    'exp' => (new DateTime())->add(new DateInterval('PT150S'))->format('U'),
    'nbf' => time() - 1,
    'iss' => clientID,
    'sub' => clientID,
    'jti' => Uuid::uuid4(),
],
file_get_contents($certPrivFile),
'RS256',
null,
[
    "alg" => "RS256",
    "typ" => "JWT",
    "x5t" => base64_encode(pack('H*', $sha1_hash)),
]
);
$authFormParameters = [
    'client_id' => clientID,
    'client_assertion_type' => 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
    'client_assertion' => $jwt,
    'scope' => 'https://graph.microsoft.com/.default',
    'grant_type' => 'client_credentials',
];

$token = json_decode($guzzle->post($url, [
'form_params' => $authFormParameters,
])->getBody()->getContents());
$accessToken = $token->access_token;
Luca Camillo
  • 796
  • 9
  • 9