1

I'm trying to integrate D365FO with a third party application, I was able to do the proper setup and register my app, fetch the Token as shown below:

enter image description here

I used the resource as the link for D365FO at the development machine, which is https://usnconeboxax1aos.cloud.onebox.dynamics.com/ and read the D365FO data as shown below:

enter image description here

I want to change the login method, so I do login on behalf of the user, using the password, so I Disabled the security details at Azure (based on this), as below:

enter image description here

And got the token of the logged user successful as below:

enter image description here

enter image description here

But once I tried fetching the same data which I was able to fetch before, I got 401 unauthorized, though I'm logging in using the Admin account:

enter image description here

halfer
  • 19,824
  • 17
  • 99
  • 186
Hasan A Yousef
  • 22,789
  • 24
  • 132
  • 203
  • Have to do some research on this. If you have access, check https://www.yammer.com/dynamicsaxfeedbackprograms/threads/1977086491377664 where something similar along these lines is described. – FH-Inway Jan 29 '23 at 18:07
  • @Hasan A Yousef, could you include the value of the **resource** parameter in the first request and your app's `API permissions` snapshot too? – Sridevi Jan 30 '23 at 07:14
  • @Sridevi the `resource` used is the default link for D365FO at the development machine, which is `https://usnconeboxax1aos.cloud.onebox.dynamics.com/` – Hasan A Yousef Jan 30 '23 at 11:57

1 Answers1

2

The error 401 Unauthorized usually occurs if you make calls to the resource with invalid audience.

When you generate the access token with scope as user.read openid profile offline_access, audience will be Microsoft Graph that won't work with D365FO.

I tried to reproduce the same in my environment via Postman and got below results:

I registered one Azure AD application and added same API permissions like below:

enter image description here

Now I generated tokens with grant type as password by including same parameters as you like below:

POST https://login.microsoftonline.com/organizations/oauth2/v2.0/token

client_id: <appID>
client_secret: <secret>
scope: user.read openid profile offline_access
grant_type: password
username: admin@xxxxxxxxx.onmicrosoft.com
password: xxxxxxxxxxx

Response:

enter image description here

You can decode the above access token by pasting it in jwt.ms to check the audience.

When I decoded the access token, I got aud claim as 00000003-0000-0000-c000-000000000000 (i.e, Microsoft Graph) like below:

enter image description here

If you use this token to read D365FO data, you will get 401 Unauthorized error as audience is invalid.

To resolve the error, you need to generate access token with resource value as base URL of your D365FO instance by making below changes:

POST https://login.microsoftonline.com/organizations/oauth2/token

client_id: <appID>
client_secret: <secret>
resource: <base URL of your D365FO instance without the trailing '/'>
grant_type: password
username: admin@xxxxxxxxx.onmicrosoft.com
password: xxxxxxxxxxx

In your case, value of resource parameter should be https://usnconeboxax1aos.cloud.onebox.dynamics.com

This token will have audience same as your D365FO root URL. To confirm that, you can decode it in jwt.ms. If you use this token to read D365FO data, it will work!

Reference:

Test services by using third-party utilities - Finance & Operations | Dynamics 365 | Microsoft

Sridevi
  • 10,599
  • 1
  • 4
  • 17