Azure AD Graph API being deprecated in favor of Microsoft Graph API

[Jnchi]

• [ ] Rename RESOURCE_ID -> RESOURCE, and assign the value to https://graph.microsoft.com.
• [ ] Change HTTP request in verify_user(), to https://graph.microsoft.com/v1.0/me.
• [ ] Abstract libcurl logic, (See: pam_aad.c).

See: Microsoft Graph or the Azure AD Graph

Resources:

• Working with Azure Active Directory resources in Microsoft Graph

[Jnchi]

Request

GET /v1.0/me HTTP/1.1
cache-control: no-cache
Postman-Token: 978f4520-c5c2-4709-9964-050480c1530d
Authorization: Bearer [ . . . REDACTED . . . ]
User-Agent: PostmanRuntime/7.6.1
Accept: */*
Host: graph.microsoft.com
Accept-Encoding: gzip, deflate
Connection: close

Response

HTTP/1.1 401 Unauthorized
Content-Type: application/json; charset=utf-8
request-id: 2e75b6d5-43c7-46f4-ab0e-e83db507e303
client-request-id: 2e75b6d5-43c7-46f4-ab0e-e83db507e303
x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"South Central US","Slice":"SliceC","Ring":"5","ScaleUnit":"003","RoleInstance":"AGSFE_IN_2","ADSiteName":"SCU"}}
WWW-Authenticate: Bearer realm="", authorization_uri="https://login.microsoftonline.com/common/oauth2/authorize", client_id="00000003-0000-0000-c000-000000000000"
Strict-Transport-Security: max-age=31536000
Date: Fri, 22 Mar 2019 17:45:00 GMT
Connection: close
Content-Length: 244

{
  "error": {
    "code": "InvalidAuthenticationToken",
    "message": "Access token validation failure.",
    "innerError": {
      "request-id": "2e75b6d5-43c7-46f4-ab0e-e83db507e303",
      "date": "2019-03-22T17:45:01"
    }
  }
}

Resources:

• Use the Microsoft Graph API

--

In get_oauth2_token(), the resource value, 00000002-0000-0000-c000-000000000000, in the POST body should be changed to https://graph.microsoft.com.

[oxr463]

@neverrend I think this might be what we discussed the other day.

[D0wn3r]

Hi ! What about that ? It is not possible to select "Azure AD Graph API" in permissions.

Downer

[oxr463]

Hi ! What about that ? It is not possible to select "Azure AD Graph API" in permissions.

Yes, see: https://github.com/aad-for-linux/aad-for-linux/issues/18#issuecomment-990818686

[D0wn3r]

Hi ! What about that ? It is not possible to select "Azure AD Graph API" in permissions.

Yes, see: aad-for-linux/aad-for-linux#18 (comment)

Thank you very much for your fast answer. I will follow it and be ready to test when it will be done