0

I have oAuth 2.0 implemented in java as per recommended in the following link https://learn.microsoft.com/en-us/exchange/client-developer/exchange-web-services/how-to-authenticate-an-ews-application-by-using-oauth.

The Azure application which I created to get consent was using "Exchange API" earlier. Since I am migrating to a new domain, I thought of Instead of migrating my existing Azure applications I can have them newly created and replace the applicationId wherever required. When I started creating a new application I didn't find "Exchange API" as an option for API Permission, so went with "Graph API" as "Exchange API" was not available.

If I use the old code where the scope is https://outlook.office365.com/Calendars.Read against the new application created (where API Permission is using Graph API) and create an OAuth token with ExchangeService as [ewsClient.Url = https://outlook.office365.com/EWS/Exchange.asmx] it is working as expected.

But when I change my Scope to https://graph.microsoft.com/.default (As I changed the API to Graph in my azure application, I thought my scope also has to be changed accordingly) and having ExchangeService as [ewsClient.Url = https://outlook.office365.com/EWS/Exchange.asmx ] it is throwing 401 at ExchangeService.bindToFolder() method from Microsoft ews-java-api jar.

Any suggestions on

Harshith Jain
  • 21
  • 4
  • Use [Microsoft Graph API](https://learn.microsoft.com/en-us/graph/api/calendar-list-events?view=graph-rest-1.0&tabs=java#example-1-list-calendar-events) to read the calendar. EWS may get deprecated soon. – Akshay G Jul 08 '22 at 08:29
  • [Authorization Code Provider](https://learn.microsoft.com/en-us/graph/sdks/choose-authentication-providers?tabs=Java#authorization-code-provider) – Akshay G Jul 08 '22 at 08:36

1 Answers1

1

https://outlook.office365.com/Calendars.Read

This isn't a Scope that will work with EWS it sounds like you maybe use the Outlook V2 endpoint as that would be a valid scope and audience for that API (which has now been depreciated).Depending on what flow you using the only valid scope for EWS are EWS.AccessAsUser.All for delegate flows and full_access_as_app for Application (Client_credentials) flow. In the first doc you linked it give a method of modifying the manifest as they removed the method of adding the permission in the portal. Graph permission won't work in EWS so https://graph.microsoft.com/.default won't be a valid scope it may return a token but that token wont have a valid audience for EWS. If you using the Client_Crendentials flow and you have given full_access_as_app then you need to use https://outlook.office365.com/.default or for delegate flow you use https://outlook.office365.com/EWS.AccessAsUser.All. It sounds like from you code you may have either both EWS or some Outlook V2 code but you need to show some of your code. What might be an easier solve for you it to look at your old manifest and look at the Guid's of the permission being used you can actually cut and paste these into the new manifest then consent to those and everything will work.

Glen Scales
  • 20,495
  • 1
  • 20
  • 23
  • Thanks for responding. I edited my question. Main issue is, with the Existing code where we are trying to read the calendar alone we have the scope set to https://outlook.office365.com/Calendars.Read. With this scope, I am getting a valid OAuth token when decoded the aud = https://outlook.office365.com/. Likewise with same code but scope as "https://graph.microsoft.com/.default" aud of my token is https://graph.microsoft.com/ as expected. But while trying to read the calendar I am getting 401. I think this error is since my Exchange service URL=https://outlook.office365.com/EWS/Exchange.asmx – Harshith Jain Jul 05 '22 at 09:44
  • outlook.office365.com/Calendars.Read is a valid scope so it will be returned in the Token but it isn't valid for EWS as per that doc you first linked and what I wrote there are only 2 valid scopes for EWS EWS.AccessAsUser.All or full_access_as_app and one valid audience outlook.office365.com (eg graph.microsoft.com isn't a valid audience for EWS and if you look at the raw https response it will actually have that in the error message). If neither of these scopes are in your token or you audience is wrong then you will get a 401 if you try to access any EWS operations. – Glen Scales Jul 05 '22 at 23:53