microsoftgraph / microsoftgraph/msgraph-sdk-dotnet

Username/password credentials no longer works for public app

Open
#1,868 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Needs: Attention :wave:
Dominant language
C#
Stars
789
Forks
264
Avg merge
15h 17m
Merged PRs (30d)
3

Description

Trying to migrate from SDK v4.35 to 5.8. We have a multi-tenant app with consent granted in other tenancies.
Authentication code is
`
var scopes = new[] { "User.Read", "Mail.ReadWrite", "Mail.ReadWrite.Shared", "Mail.Send", "Mail.Send.Shared" };

            var theOptions = new TokenCredentialOptions
            {
                AuthorityHost = AzureAuthorityHosts.AzurePublicCloud
            };

            var userNamePasswordCredential = new UsernamePasswordCredential(theAccount, thePassword, theTenantID, theAppID,theOptions);
           
            graphClient = new GraphServiceClient(userNamePasswordCredential, scopes);`

This no longer works in v5, when trying to access mailfolders giving this error which suggests it does not work multi-tenant

UsernamePasswordCredential authentication failed: AADSTS50020: User account '{EmailHidden}' from identity provider 'https://sts.windows.net/34dc47b4-7068-4e4c-9fd0-df28979f3c6b/' does not exist in tenant 'Arcivate Ltd' and cannot access the application 'a40a20d3-f53a-4c23-8c98-8cee091b51af'(ARCMailImpMSG) in that tenant.

Expected behavior
Token provided

Desktop (please complete the following information):

  • OS: Windows 10 (testing) and 2012 server (productio env.)
  • Browser N/A
  • Version
    Additional context
    Add any other context about the problem here.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the UsernamePasswordCredential setup shown in the issue and compare its behavior between SDK v4.35 and v5.8, paying particular attention to the tenant and application identifiers. Reproduce the mail-folder request with the stated scopes and determine whether the AADSTS50020 error is caused by credential behavior or multi-tenant configuration; done means the token is provided and the request succeeds.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp
Domain
api, authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.