Azure-Samples / ms-identity-java-desktop

A desktop application in Java calling Microsoft Graph API
MIT License
22 stars 23 forks source link

tenant id missing #8

Closed anotherrohit closed 4 years ago

anotherrohit commented 4 years ago

Where do I plug in the tenantid in this example in sample_cache.json. I am getting below error in the usernamePassword example [ForkJoinPool.commonPool-worker-1] ERROR com.microsoft.aad.msal4j.PublicClientApplication - [Correlation ID: 5f9285a6-f2f4-4a95-b1f2-c45b45925620] Execution of class com.microsoft.aad.msal4j.AcquireTokenSilentSupplier failed. com.microsoft.aad.msal4j.MsalClientException: Token not found it the cache at com.microsoft.aad.msal4j.AcquireTokenSilentSupplier.execute(AcquireTokenSilentSupplier.java:58) at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:59) at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:17) at java.util.concurrent.CompletableFuture$AsyncSupply.run(Unknown Source) at java.util.concurrent.CompletableFuture$AsyncSupply.exec(Unknown Source) at java.util.concurrent.ForkJoinTask.doExec(Unknown Source) at java.util.concurrent.ForkJoinPool$WorkQueue.runTask(Unknown Source) at java.util.concurrent.ForkJoinPool.runWorker(Unknown Source) at java.util.concurrent.ForkJoinWorkerThread.run(Unknown Source) [ForkJoinPool.commonPool-worker-1] ERROR com.microsoft.aad.msal4j.PublicClientApplication - [Correlation ID: 7c045e8c-3a86-43a4-88a3-4570aefa1813] Execution of class com.microsoft.aad.msal4j.AcquireTokenByAuthorizationGrantSupplier failed. com.microsoft.aad.msal4j.MsalServiceException: AADSTS90019: No tenant-identifying information found in either the request or implied by any provided credentials.

What am I missing

Avery-Dunn commented 4 years ago

@anotherrohit : Hello, you shouldn't need to explicitly configure the tenant anywhere in that sample.

I haven't been able to reproduce your issue, though on my end the sample is working after only configuring the client ID and username/password. Have you made any other changes to the sample, other than configuring client ID/username/password?

One thing you can try is changing the authority endpoint to use your specific tenant. In the same place as CLIENT_ID, USERNAME, etc., change the 'organizations' section of the AUTHORITY URL from: private final static String AUTHORITY = "https://login.microsoftonline.com/organizations/"; to private final static String AUTHORITY = "https://login.microsoftonline.com/{your tenant ID}/";

That suggestion is kind of a shot in the dark since I can't reproduce your issue on my end, but it's the only place I can think of in that sample where the tenant could be configured and either URL style is working for me.

anotherrohit commented 4 years ago

@Avery-Dunn thank you. That was the location I was not sure, after updating I see a different error. Does the MFA prompt not work in the usernamepassword or IWA flow? If not what can I do to accommodate the 2nd factor in the code. Caused by: com.microsoft.aad.msal4j.MsalInteractionRequiredException: AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '00000003-0000-0000-c000-000000000000'. Trace ID: 949c70cb-8c10-4117-bd0e-5c14ab059300 Correlation ID: 87682885-c9f8-4eb2-a2eb-10b2fca05dba Timestamp: 2020-06-09 20:07:40Z

Avery-Dunn commented 4 years ago

I don't believe MFA is compatible with the username/password flow or the IWA flow.

Depending on your use case, I'd recommend looking at the sample for device code flow or this page about interactive flow. Those samples don't cover using MFA specifically, but those flow types should be fully compatible with MFA.