Authentication Failure - Application is not supported for this API version

[jharbert]

Hi guys,

Wondering if you have seen an issue giving an unauthorized_client error, saying AADSTS70001: Application '<client_id>' is not supported for this API version.

My callback URLs are set up correctly, but upon successful authentication on Azure I'm redirected back and receive the error.

E, [2016-04-20T10:06:57.658856 #90049] ERROR -- omniauth: (microsoft_office365) Authentication failure! unauthorized_client: OmniAuth::Strategies::OAuth2::CallbackError, unauthorized_client | AADSTS70001: Application 'xxxxx-xxxxx-xxxxx-xxxxx' is not supported for this API version

As some background, I've been able to successfully authenticate using Microsoft's example Rails app (https://github.com/OfficeDev/O365-Ruby-Microsoft-Graph-Connect) that uses the omniauth-azure-activedirectory gem. It may be worth noting for someone that their example app skips the authentication token verification and instead does it manually. It fails otherwise.

So, I know to some extent logging in works, but I can't seem to get this gem working. If it helps, the URL that I am taken to upon clicking the login link is:

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=xxxxx-xxxxx-xxxxx-xxxxx&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fusers%2Fauth%2Fmicrosoft_office365%2Fcallback&response_type=code&scope=openid+email+profile+https%3A%2F%2Foutlook.office.com%2Fcontacts.read&state=a910eb04594c40933bb3585fba9036fa6176294c18b82f86

My provider is defined in my devise initializer (along with my other working social providers):

config.omniauth :microsoft_office365, ENV['OFFICE365_KEY'], ENV['OFFICE365_SECRET']

[murbanski]

Jeez... I swear I saw it somewhere:/ I think it was here, when I was trying to use that older gem: simi/omniauth-office365#7

This probably was the reason I started writing my own gem. But didn't notice anything similar and we use this one on production systems daily:/

[jharbert]

I'm pretty sure the issue is because I created my application inside of the Azure Management Portal, which would seem like a logical place to create the application. I also created an app via a link from the development documentation itself in the Office365 App Registration Tool, which one might also believe is a good spot to create their app.

But no! Apparently you cannot create your app in either of the above two places that Microsoft tells you to create your app. You have to create it in the new Application Registration Portal, which sounds way too similar to the existing 'Application Registration Tool'. Let's not even get into the fact that they have two versions of the Azure Management Portal, one of which doesn't have an active directory section built for it.

(Also explained here: https://azure.microsoft.com/en-us/documentation/articles/active-directory-v2-app-registration/)

Creating an app in the 'Application Registration Portal' then directs me to go manage it in the 'Azure Management Portal'. Using this new client_id and client_secret, I get a login and I can verify permissions, however Microsoft stalls there because 'an error occurred'. I believe it is because this new app does not have proper application permissions set. Alas, when I try and save I get an error message notifying me that it cannot save and I'll need to contact support if it continues.

Really, Microsoft? I'll update this if I get everything worked out.

[jharbert]

Closing this one out. That was the issue - apps using the v2.0 endpoints need to be created in the new application registration portal (https://apps.dev.microsoft.com). Set your redirect URIs there and not in Azure.

[murbanski]

Thanks @jharbert for sharing this! Microsoft's documentation is confusing at times...

[cbordeman]

I created my app in the new application registration portal (https://apps.dev.microsoft.com) and yet this error still occurs. Lots of people are using the new portal and still getting this error. Why hasn't the team been all over this?

[hnrchrdl]

It has been a while, but this issue seems still to exist. With apps registered in the Azure Portal (https://portal.azure.com) I still get the same error. But when I register them in the application registration portal ([https://apps.dev.microsoft.com] https://apps.dev.microsoft.com), it works. This really confuses me, and surely many others, too.

[jhagege]

+1

[CaptainHypertext]

Yeah, looks like they've yet again made a new place to register applications, and those who use the newer versions of graph api should register there 🙄

[beders]

Maybe worth a mention in the README.