Fobidden error about aspnet-webhooks-rest-sample

[DianeD]

Hi @apryiomka . I tried to reproduce your issue with a fresh install and registration, but it's working for me.

So mine is using just AAD "Sign in and read user profile" and Microsoft Graph "Mail.Read" for an Office 365 work account.

[cveld]

I had the same issue :( For simplicity's sake I just signed out from the demo app, removed the app registration from AAD, and added it again. New client id and client secret. This time I generated the secret after I had assigned the required additional permission.

I think the issue was that I gave consent early on on a limited permission set. Afterwards I added the permission, but did not refresh any token. Ideally I would like to learn how I can enforce the refreshing when we will be adding permissions during the lifecycle of the app.

[DianeD]

Hi @cveld . Thanks for reporting this. Do you get the error when retrieving a changed email message? Are you getting error code "Authorization_RequestDenied" and message "Insufficient privileges to complete the operation."?

[cveld]

No I got the forbidden error when subscribing to the webhook. Sorry that I did not capture the full error json. Maybe I will register a new app without the required Mail.Read permission and enforce the error again.

[DianeD]

@cveld , I think I misread your first message. Did you resolve your Forbidden error by re-registering/regenerating the secret?

Regarding your question about adding permissions, that's supported with the Azure AD v2.0 endpoint. You can see how the flow works in the ASP.NET snippets sample, though that sample uses the MSAL auth library instead of ADAL. And this Azure AD sample describes the flow in detail in the “Handling incremental consent…” section.

[cveld]

We tried to resolve with only regenerating the secret. But this was not
enough. In the end we just registered a new app to get it work. Maybe we
just had to drop the user's consent first to resolve it more gracefully.

2016-11-15 19:24 GMT+01:00 DianeD [email protected]:

@cveld https://github.com/cveld , I think I misread your first message.
Did you resolve your Forbidden error by re-registering/regenerating the
secret?

Regarding your question about adding permissions, that's supported with
the Azure AD v2.0 endpoint
https://azure.microsoft.com/en-us/documentation/articles/active-directory-appmodel-v2-overview.
You can see how the flow works in the ASP.NET snippets sample
https://github.com/microsoftgraph/aspnet-snippets-sample, though that
sample uses the MSAL auth library instead of ADAL. And this Azure AD
sample
https://github.com/Azure-Samples/active-directory-dotnet-webapp-openidconnect-v2
describes the flow in detail in the “Handling incremental consent…” section.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#5 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AF6MJE7xQ4V24exqDJdpnU92J4qsPdltks5q-fjbgaJpZM4Ki6-V
.

[DianeD]

Thanks again for the feedback! Added this use case to the Troubleshooting section of the readme. Closing this issue. @apryiomka , please reopen if this doesn't resolve your issue.