authenticationoauth-2.0azure-active-directoryskype-for-businessucwa

Authentication using Azure AD, failing at last step accessing Skype for Business

I am following this guide (https://learn.microsoft.com/en-us/skype-sdk/ucwa/authenticationusingazuread) in order to access Skype for Business. Everything goes fine till the last part but let's do step by step. I am building my .net console application to do this but in order to explain you properly the problem I am having I will show you directly the http calls through Insomnia (software used to make http calls).

Step 1: GET request towards https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root I hit 200 and as answer I receive this:

enter image description here

Step 2: I use the user link. So I send an http request to https://webdir1e.online.lync.com/Autodiscover/AutodiscoverService.svc/root/oauth/user and I get a 401 Unauthorized (everything still correct). In the header of the answer it points me to the Identity Provider to ask for authorization (authorization_uri)

enter image description here

Step 3: I use that link to authorize my app, which has its own client_Id (that I hide in the following screenshot). This is how I compose the call:

enter image description here

If I send this http request I get redirected to the page where it asks my personal login and by inserting my credentials I succesfully login and hit 404, where in the answer I receive back my access token.

Step 5: I use the access token towards the same AutodiscoverService link of step 1. This is to register my application. I hit 200 and I receive back the link to access Skype for Business.

enter image description here

Finally (and this is where things go wrong) I send a POST request towards the applications link with the Bearer token, and I receive a 403 Forbidden. I think I am following correctly the guide but I can't figure out why I can access the resource at the last step.

EDIT:

The permissions are granted. I hide the name since it contains the name of my company. But it is the same of the domain of my login.

enter image description here

Solution

  • So the token you generated authorizes you to access resources at https://webdir1e.online.lync.com which you've done to fetch a new set of resources including the "application" resouce which is on a DIFFERENT host: https://webpooldb41e14.infra.lync.com.

    You actually have to get another OAuth token now which authorizes you for the application resource and then you can POST to that to generate your session in UCWA.

    As a side note... If you've defined your own single-tenant application in Azure that has been granted rights to SkypeForBusinessOnline then I think you should be targeting authorization and authentication endpoints of the form:

    https://login.microsoftonline.com/{tenantID}/oauth2/v2.0/authorize https://login.microsoftonline.com/{tenantID}/oauth2/v2.0/token

    Also I should add, if you're trying to write a trusted secure client that users in your company will use I would suggest looking up the Resource Owner Password Credentials auth flow. It allows you to directly hit the token endpoint I mentioned above and exchange username/password credentials for an access token. Then you can manage auto-discovery and application creation easily under the hood without getting re-directed back and forth to Azure.

    https://learn.microsoft.com/mt-mt/azure/active-directory/develop/v2-oauth-ropc