Search code examples
azureoauth-2.0azure-active-directory

Azure AD OAuth token wrong audience (client credentials flow)

I am trying to get a OAuth token (client_credentials flow) to be able to call my API. I cannot get the proper audience in the token.

In Azure AD, I created 2 App Registration. One to represent my API, the other one to represent my Client.

In my API App Registration, I exposes an API App Registration - Expose an API

As you can see in the screenshot I also added my Client App Registration as an "Authorized client applications".

I also added an App Role. App Role

In my Client App Registration, I created a secret to authenticate.

I also added my API App Registration in the "API Permissions" and also Granted Admin Consent.

API Permission

My problem is when I am trying to get a token from Azure AD. I do the following in Postman : enter image description here

But the token I get does not contain the audience I specified. It contains the default "Graph API" Audience. enter image description here

I've been reading on OAuth for the past 2 days but I can't figure out what I am doing wrong.

Also, please note that I cannot use the v2.0 endpoint because in the end, I do all this to be able to authenticate to my API in Power Automate and I don't have the option to use the v2.0 endpoint (and the resource or scope parameters).

enter image description here

Here's the token decoded

enter image description here

Any help will be greatly appreciated.

Solution

  • In summary, I will post it as an answer.

    Like I said in the comments, if you are using the OAuth 2.0 protocol, when you use the v1.0 endpoint to request an access token, you should use the resource parameter instead of the audience parameter, because the audience parameter is not recognized by the OAuth 2.0 protocol. Even if you do not selected this parameter in postman, you should be able to obtain a default ms graph api token.

    The audience parameter is commonly used in Auth0 organization, but it has some differences from the OAuth 2.0 protocol. The request URL of Auth0 is as follows:

    curl --request POST \
  --url 'https://YOUR_DOMAIN/oauth/token' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials \
  --data client_id=YOUR_CLIENT_ID \
  --data client_secret=YOUR_CLIENT_SECRET \
  --data audience=YOUR_API_IDENTIFIER