0

Hello Microsoft/Azure/Skype experts,

I'm tasked with accessing presence data from Skype For Business Online accounts from my macOS app (native). I'm unfortunately stuck and i always get a 403 error when i access the autodiscover request and never get the link to the applications resource

I have been following this documentation https://learn.microsoft.com/en-us/skype-sdk/ucwa/authenticationusingazuread

STEP 1 We have registered the app in the Azure Management Portal using our Office 365 account credentials.

  • We have used custome redirect URL (http://localhost)
  • Allow Implicit Flow is set to true in manifest
  • We pre-configure the permissions needed for Skype for business online enter image description here

STEP 2 Issuing a GET as specified in the documentation to initiate sign in and authorization check.

GET https://login.microsoftonline.com/common/oauth2/authorize?response_type=token&client_id=c#####-4d41-485e-871f-0a22aa79e52b&redirect_uri=http://localhost

This returns a 200 OK.

STEP 3 We got the Auto discover URL as described in the documentation. This is what i get - i use the domain marked in RED. enter image description here

STEP 4 As per the documentation, they ask me to do this

Requesting an access token using implicit grant flow So i issue a GET as described

https://login.microsoftonline.com/oauth2/authorize? response_type=id_token &client_id=######-4d41-485e-871f-0a22aa79e52b &redirect_uri=http://localhost &state=8f0f4eff-360f-4c50-acf0-99cf8174a58b &resource=https://webdirin1.online.lync.com

Now this shows the sign in page, i sign in and then it throws an error

AADSTS90014%3a+The+required+field+%27nonce%27+is+missing.

I researched and could not fix this error. So after lots of research and looking at this Microsoft documentation LINK (https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#requesting-individual-user-consent) , apparently there is another way of getting the bearer token.

STEP 4 - SECOND TRY

I then Request individual user consent by sending the SCOPE parameter for Skype for Business. I then issue a GET request to

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=#######-4d41-485e-871f-0a22aa79e52b&response_type=code&redirect_uri=http://localhost&response_mode=query&scope=https://api.skypeforbusiness.com/User.ReadWrite&state=12345

This returns an access code which i use in next step to get the TOKEN

STEP 5 - Get the bearer TOKEN

Issue a POST to following URL https://login.microsoftonline.com/common/oauth2/v2.0/token With the following data in POST body

"grant_type": "authorization_code", "client_id": "######-4d41-485e-871f-0a22aa79e52b", "scope": "https://api.skypeforbusiness.com/User.ReadWrite", "code": "OAQABAAIAAACEfexX.........", "redirect_uri": "https://localhost"

This returns the bearer token in the following response JSON

{
"access_token" = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1........w4b--    gnWG_iOGtQ";
"expires_in" = 3599;
"ext_expires_in" = 3599;
scope = "https://api.skypeforbusiness.com/User.ReadWrite";
"token_type" = Bearer;
}

STEP 6

Yay! Got the bearer token at laaast! Now back to the main documentation https://learn.microsoft.com/en-us/skype-sdk/ucwa/authenticationusingazuread

And where we do this - 'Resending an autodiscovery request with the bearer token' We execute a GET request to

https://webdirin1.online.lync.com/Autodiscover/AutodiscoverService.svc/root/oauth/user

Now this, as per the documentation should return this JSON

{
            "_links":{
            "self": 
     {"href":"https://webdirX.online.lync.com/Autodiscover/AutodiscoverService.svc/root/user"},
         "applications": 
        {"href":"https://webpoolXY.infra.lync.com/ucwa/oauth/v1/applications"}
         }
         }

BUT i GET A 403: PERMISSIONS denied error

<div class="content-container"><fieldset>
 <h2>403 - Forbidden: Access is denied.</h2>
 <h3>You do not have permission to view this directory or page 
  using the credentials that you supplied.</h3>
</fieldset></div>

So thus i have never got the applications url and I have checked the manifest, registration and i have no idea, why i get this error.

Any inputs would be appreciated.

KamyFC
  • 858
  • 9
  • 17
  • 1
    For step 4, you need to specify `nonce=somestring` in the URL. Typically this should be a securely random value that is only used once. It can contain any value. – juunas Mar 18 '19 at 01:15
  • @junnas has a good suggestion.. additionally, I see that after Step 4 you have switched to using `v2.0` endpoint to get token. Don't mix up the endpoints, and continue using the same one as documentation suggested as it's related to how you registered your application in first place. – Rohit Saigal Mar 18 '19 at 01:40
  • @juunas Thanks that helped solve the error - but i get an id_token as a response and dont get the access_token and if use that i still get 403 error – KamyFC Mar 18 '19 at 13:01
  • You are only requesting an id token. Set `response_type=id_token+token`. – juunas Mar 18 '19 at 14:33
  • @juunas Thank you. That solved it, am able to get the application URL. It's incredible that MS documentation does not mention the options you told me. But now i need to POST to the applications URL and i get a "502 - Web server received an invalid response while acting as a gateway or proxy server." Do i need to send the same access token? I will keep trying. You have been very helpful. Thank you. – KamyFC Mar 21 '19 at 06:15
  • Okay that sounds like more of a problem with Skype's API. A 502 is usually a kind of a connection problem. Yeah the docs could be clearer on the possible params. – juunas Mar 21 '19 at 21:26
  • @juunas Thanks Juunas - The issue is resolved. You can mention your response as the answer - specify nonce=somestring in the URL & response_type=id_token+token I will MARK as Answer. – KamyFC Mar 26 '19 at 04:03
  • @kamyFC Sir.. Please answer my question, https://stackoverflow.com/questions/57170656/skype-for-business-receive-im-not-working-with-the-below-steps .. I am not able to receive im, in skype for business UCWA api. As you have already worked on this, I am not able to receive any IM in UCWA. Please guide me sir. – curious_one Jul 27 '19 at 07:23

1 Answers1

1

For step 4, you need to specify nonce=somestring in the URL. Typically this should be a securely random value that is only used once. It can contain any value.

Also, you are only requesting an id token. Set response_type=id_token+token.

juunas
  • 54,244
  • 13
  • 113
  • 149
  • Thanks for your help! – KamyFC Mar 26 '19 at 12:10
  • @juunas Sir.. Please answer my question, https://stackoverflow.com/questions/57170656/skype-for-business-receive-im-not-working-with-the-below-steps .. I am not able to receive im, in skype for business UCWA api. As you have already worked on this, I am not able to receive any IM in UCWA. Please guide me sir. – curious_one Jul 27 '19 at 07:25