Ошибка authorization has been denied for this request

• Remove From My Forums

• Question

• I have a simple ASP.Net web application consist of .aspx web from hosted on azure as cloud service. In my application there is no user login.
  I want to connect with Microsoft Graph API and and to use Microsoft Bookings API to get the BookingBusiness collection on my home page load without user login. I am currently debugging my web app on my desktop using Azure emulator.
  I have the ofiice 365 premium account access assoiciated with my microsoft account (XXXXX@microsoft.com) and I had created a Booking business using my v- alias through Booking tools (https://outlook.office.com/owa/?path=/bookings).
  I registered an app in AAD in the same tenant with all required permission and provided the Cliend Id and secret in the code to get the access token. I am using Client credentials Grant flow to get the access token and try to invoke the booking API.
  I am able to get the access token, but when the code try to get the the list of booking businesses it is giving below exception.

  DataServiceClientException: {
    «error»: {
      «code»: «»,
      «message»: «Authorization has been denied for this request.»,
      «innerError»: {
        «request-id»: «d0ac6470-9aae-4cc2-9bf3-ac83e700fd6a»,
        «date»: «2018-09-03T08:38:29»
      }
    }
  }

  The code and registered app setting details are in below screen shot.

          private static async Task<AuthenticationResult> AcquireToken()
          {
              var tenant = "microsoft.onmicrosoft.com"; //"yourtenant.onmicrosoft.com";
              var resource = "https://graph.microsoft.com/";
              var instance = "https://login.microsoftonline.com/";
              var clientID = "7389d0b8-1611-4ef9-a01f-eba4c59a6427";
              var secret = "mxbPBS10|[#!mangJHQF791";
              var authority = $"{instance}{tenant}";
              var authContext = new AuthenticationContext(authority);
              var credentials = new ClientCredential(clientID, secret);           
  
              var authResult = await authContext.AcquireTokenAsync(resource, credentials);
              
              return authResult;
          }
  
  
          protected void MSBooking()
          {               
              var authenticationContext = new AuthenticationContext(GraphService.DefaultAadInstance, TokenCache.DefaultShared);
              var authenticationResult =  AcquireToken().Result;
  
                        
  	    var graphService = new GraphService(
              GraphService.ServiceRoot,
              () => authenticationResult.CreateAuthorizationHeader());
  
             // Get the list of booking businesses that the logged on user can see.
              
              var bookingBusinesses = graphService.BookingBusinesses; ----- this line throwing an exception "Authorization has                                been denied for this request."
          }

  GraphService.cs

  // ---------------------------------------------------------------------------
  // <copyright file="GraphService.cs" company="Microsoft">
  //     Copyright (c) Microsoft Corporation.  All rights reserved.
  // </copyright>
  // ---------------------------------------------------------------------------
  
  namespace Microsoft.Bookings.Client
  {
      using System;
      using System.Net;
  
      using Microsoft.OData;
      using Microsoft.OData.Client;
  
      public partial class GraphService
      {
          /// <summary>
          /// The resource identifier for the Graph API.
          /// </summary>
          public const string ResourceId = "https://graph.microsoft.com/";
  
          /// <summary>
          /// The default AAD instance to use when authenticating.
          /// </summary>
          public const string DefaultAadInstance = "https://login.microsoftonline.com/common/";
  
          /// <summary>
          /// The default v1 service root
          /// </summary>
          public static readonly Uri ServiceRoot = new Uri("https://graph.microsoft.com/beta/");
  
          /// <summary>
          /// Initializes a new instance of the <see cref="BookingsContainer"/> class.
          /// </summary>
          /// <param name="serviceRoot">The service root.</param>
          /// <param name="getAuthenticationHeader">A delegate that returns the authentication header to use in each request.</param>
          public GraphService(Uri serviceRoot, Func<string> getAuthenticationHeader)
              : this(serviceRoot)
          {
              this.BuildingRequest += (s, e) => e.Headers.Add("Authorization", getAuthenticationHeader());
          }
  
          /// <summary>
          /// Gets or sets the odata.maxpagesize preference header.
          /// </summary>
          /// <remarks>
          /// Using the Prefer header we can control the resulting page size of certain operations,
          /// in particular of GET bookingBusinesses(id)/appointments and bookingBusinesses(id)/customers.
          /// </remarks>
          public int? MaxPageSize
          {
              get;
              set;
          } = null;
  
          /// <summary>
          /// Gets or sets the odata.continue-on-error preference header.
          /// </summary>
          /// <remarks>
          /// Using the Prefer header we can control if batch operations stop or continue on error.
          /// </remarks>
          public bool ContinueOnError
          {
              get;
              set;
          }
  
          /// <summary>
          /// Gets or sets the web proxy to use when sending requests.
          /// </summary>
          public IWebProxy WebProxy
          {
              get;
              set;
          }
  
          partial void OnContextCreated()
          {
              // Default to send only the properties that were set on a data object
              this.EntityParameterSendOption = EntityParameterSendOption.SendOnlySetProperties;
  
              // Allows new results to override cached results, if the object is not changed.
              this.MergeOption = MergeOption.PreserveChanges;
  
              if (this.BaseUri.AbsoluteUri[this.BaseUri.AbsoluteUri.Length - 1] != '/')
              {
                  throw new ArgumentException("BaseUri must end with '/'");
              }
  
              this.BuildingRequest += (s, e) => e.Headers.Add("client-request-id", Guid.NewGuid().ToString());
  
              this.SendingRequest2 += (s, e) =>
                  {
                      var requestMessage = e.RequestMessage as HttpWebRequestMessage;
                      if (requestMessage != null)
                      {
                          var preferenceHeader = new ODataRequestOnHttpWebRequest(requestMessage.HttpWebRequest).PreferHeader();
                          preferenceHeader.MaxPageSize = this.MaxPageSize;
                          preferenceHeader.ContinueOnError = this.ContinueOnError;
  
                          requestMessage.HttpWebRequest.Proxy = this.WebProxy;
                      }
                  };
          }
      }
  }

  • Edited by

    Monday, September 3, 2018 3:38 PM
    Edited PII Data

{
    "message": "Authorization has been denied for this request."
}

curl -k -X POST https://login.microsoftonline.com/botframework.com/oauth2/v2.0/token -d "grant_type=client_credentials&client_id=<APP ID>&client_secret=<APP PASWORD>&scope=https%3A%2F%2Fapi.botframework.com%2F.default"

URL:
https://smba.trafficmanager.net/apis/v3/conversations/<CONVERSATION ID>/activities/<MESSAGE ID>

HEADERS:
Postman-Token: <calculated when request is sent>
Content-Lenght: <calculated when request is sent>
Host: <calculated when request is sent>
Content-Type: application/json
Authorization: Bearer 0SzRndyIsImtpZCI6ImppYk5ia0ZTU2JteFBZck45Q0...

BODY:
{
    "type": "message",
    "from": {
        "id": <BOT ID>,
        "name": <BOT NAME>
    },
   "recipient": {
        "id": <USER ID>,
        "name": <USER NAME>
    },
    "text": <MESSAGE>
}

Many of the APIs that require Access Approval or are Private require secondary authentication information. This is usually a Basic Authorization Header (a base64 encoded ucsbNetId:password combination) which will be used by the backend system to authenticate who or what application is calling into the API service. As a client you would be aware if a system required secondary authentication information, as you would be asked to provide a UcsbNetId when applying for access.

When the service is called, if the UcsbNetId/Password combination can’t be authenticated successfully, or the UcsbNetId hasn’t been authorized to access the API a common error message of "message": "Authorization has been denied for this request." may be replied.

Some common mistakes that lead to this error message are:

• Not including a Basic Authorization Header.
• Forgetting to base64 encode the ucsbNetId:password combination.
• The API provider hasn’t added your ucsbNetId to the authorization systems.

If you are sure you’re doing the first two above, please reach out to support@developer.ucsb.edu to see if your application’s ucsbNetId can be added.