question

Hello @AkhleshVerma-4607,

Thanks for reaching out.

As per the request id and timestamp ("requestId":"f192ac37-8b05-4a81-a582-13f0f5ca3594" & date:"2021-12-23T11:41:23"), I see that the token was still created with the Azure AD Graph audience "https://graph.windows.net/" rather than the Microsoft Graph audience "https://graph.microsoft.com/", which results in the HttpStatusCode:403:Authorization RequestDenied error.

As a result, I'd like to request that you revisit and decode your code to ensure that the audience (aka resource) is set to Microsoft Graph: https://graph.microsoft.com/. Additionally, you may check the audience by decoding access token from https://jwt.ms.

Based on my research, I believe you should develop an AuthenticationProvider object as explained below articles which authenticate request to Microsoft Graph. See select a Microsoft Graph authentication provider for an example of how to obtain an authentication provider.

msgraph-sdk-go: https://github.com/microsoftgraph/msgraph-sdk-go
sdk-go-core: https://github.com/microsoftgraph/msgraph-sdk-go-core
msgraph-beta-sdk-go: https://github.com/microsoftgraph/msgraph-beta-sdk-go

---

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Hi @sikumars-msft ,
I tried to create authorisation provider as per your suggestion from https://github.com/microsoftgraph/msgraph-sdk-go-core example, but getting error as it is not inherited autorest.Authorizer interface.

below is the code :

func getApplicationsClient(clientID, clientSecret, tenantID string) (graphrbac.ApplicationsClient, error) {

appClient := graphrbac.NewApplicationsClient(tenantID)
cred, err := azidentity.NewClientSecretCredential(
tenantID,
clientID,
clientSecret,
nil,
)
if err != nil {
log.Error(err, "Failed to get Secret Credential")
return appClient, err
}
auth, err := azureauth.NewAzureIdentityAuthenticationProvider(cred)
if err != nil {
log.Error(err, "Failed to get authentication provider")
return appClient, err
}
appClient.Authorizer = auth
appClient.AddToUserAgent("cloudcasa-agent")
return appClient, nil
}

It is giving me compilation error,
*microsoft_kiota_authentication_azure.AzureIdentityAuthenticationProvider does not implement autorest.Authorizer (missing WithAuthorization method)
../../amdslib/s3provider/provider/azure/azurebackupprovider.go:286:22: cannot use auth (type *microsoft_kiota_authentication_azure.AzureIdentityAuthenticationProvider) as type autorest.Authorizer in assignment:


Also there is nothing i found in microsoft Graph code which is using "autorest" package i.e.
" github.com/Azure/go-autorest/autorest"
" github.com/Azure/go-autorest/autorest/azure"

 import (
     "context"
    
     azidentity "github.com/Azure/azure-sdk-for-go/sdk/azidentity"
     a "github.com/microsoft/kiota/authentication/go/azure"
     msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
 )
    
 cred, err := azidentity.NewClientSecretCredential(
     "TENANT_ID",
     "CLIENT_ID",
     "CLIENT_SECRET",
     nil,
 )
    
 auth, err := a.NewAzureIdentityAuthenticationProviderWithScopes(cred, []string{"User.Read"})
    
 adapter, err := msgraphsdk.NewGraphRequestAdapter(auth)
    
 client := msgraphsdk.NewGraphServiceClient(adapter)
    
 result, err := client.Me().Get(nil)

Hi,

I am trying to create Azure AD app using the code present on https://github.com/Azure-Samples/azure-sdk-for-go-samples/blob/b49c4162aa1d96bc2b1b42afecbf4a21b420e568/graphrbac/graph.go#L53 , but since the Windows Active directory Graph API are obsolete and we need to use Microsoft Graph API instead.

I am getting this 403 error. So my question is how we can create Azure AD app using https://github.com/Azure-Samples/azure-sdk-for-go-samples/blob/b49c4162aa1d96bc2b1b42afecbf4a21b420e568/graphrbac/graph.go#L53 this code by calling Microsoft Graph API from this code.

The code you mentioned above is same as i have posted in my previous comment, but as i said i am having compilation error with that and the reason is type *microsoft_kiota_authentication_azure.AzureIdentityAuthenticationProvider has not implemented autorest.Authorizer interface.

Hi @zehuiyaomsft-7151,

Please find screenshot for the decoded access token:

Just to update you that I can create app using postman with the help of Microsoft Graph API, but from my code i am getting 403 error, it seems that azure-sdk-for-go is still using windows Graph API.

Is there any way we can tweak it and use Microsoft Graph API ?
https://github.com/Azure-Samples/azure-sdk-for-go-samples/blob/master/graphrbac/graph.go#L53 I am basically pointing to this function.