Search code examples
javaspring-bootazureazure-active-directoryspring-cloud

AADSTS28004: The provided value for the input parameter 'scope' exceeded the number of scopes allowed

enter image description here

I'm using spring-cloud-azure-starter-active-directory to integrate my webapp with azure AAD.

Previously my web app only need 3 api services, but when I add 1 more (webApi-4) I get this issue. Is there any way to get out of this? I google for a while but can not find the solution.

This is my configuration yaml: ![enter image description here

Solution

  • For sample, I used the below authorize endpoint to authorize the users:

    https://login.microsoftonline.com/TenantID/oauth2/v2.0/authorize?
&client_id=ClientID
&response_type=code
&redirect_uri=https://jwt.ms
&response_mode=query
&scope=profile openid offline_access api://xxx/BEApp.access api://xxx/claim.read api://xxx/jango-test-api api://xxx/group.read
&state=12345

    And got the same error as below:

    enter image description here

    The error "AADSTS28004: The provided value for the input parameter 'scope' exceeded the number of scopes allowed" usually occurs if you are scopes more than 3 resources in your login request. Refer this GitHub Blog by tnorling.

    Note that: If the web APIs have different applications, then you need to generate the access token separately as one token can only be issued to one audience. You cannot acquire access token for multiple audience Refer this SO Thread by me.

    You can make use of client credential flow and assign app role to the user like below:

    Created a Microsoft Entra application and added an app role:

    enter image description here

    Exposed and API and added scope:

    enter image description here

    Granted API permissions:

    enter image description here

    Add the user to the role in the Enterprise application:

    enter image description here

    Generated auth-code:

    https://login.microsoftonline.com/TenantID/oauth2/v2.0/authorize?
&client_id=ClientID
&response_type=code
&redirect_uri=https://jwt.ms
&response_mode=query
&scope=api://ID/.default
&state=12345

    enter image description here

    Generated tokens like below:

    https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id:ClientID  
scope:api://ID/.default openid offline_access
grant_type:authorization_code  
code:code  
redirect_uri:https://jwt.ms
client_secret:Secret

    enter image description here

    When I decoded the access token roles and scp is present:

    enter image description here

    Otherwise, you can also make use of client credential flow and assign app role to user.