Azure-docs: Bug Report: Generated Access Token With Wrong Scopes

[johnz]

Actual behavior:

• Access Token scope is "profile openid email"

Expected behavior:

• Access Token should have scope "AuditLog.Read.All Directory.Read.All Reports.Read.All SecurityEvents.Read.All User.Read.All profile openid email"

Step to reproduce:

1. Register a new app in Azure portal App registrations
2. Use OAuth 2 v2.0 code grant flow to get access_token and refresh_token
   
   
   
   • login url https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/authorize?client_id={clientId}&response_type=code&redirect_uri=https%3A%2F%2Fabc.ngrok.io%2Fclient-callback&response_mode=query&scope=offline_access+User.Read.All+Reports.Read.All+AuditLog.Read.All+Directory.Read.All+SecurityEvents.Read.All
   
   
   • login as Partner Center Admin(https://partner.microsoft.com) and give the app permission to access {tenantId}
   
   
   • Partner Center Admin has Delegate Access to the {tenantId}
   
   
3. Got access_token and refresh_token using authorization_code grant_type
   
   
   
   • both {tenantId} and scopes are correct in access_token
   
   
4. Use refresh_token to generate new access_token
   
   
   
   • POST https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token
     
     Body:
     
     client_id={clientId}
     
     &scope=profile openid email User.Read.All Reports.Read.All AuditLog.Read.All Directory.Read.All SecurityEvents.Read.All
     
     &refresh_token={refresh_token}
     
     &grant_type=refresh_token
     
     &client_secret={clientSecret}
   
   
5. In response the scope is "profile openid email"
   
   
   
   • x-ms-request-id: 953855f8-9d5a-4ad6-aef4-622afb3f6800
   
   
   • x-ms-ests-server: 2.1.9587.8 - HKG2 ProdSlices
   
   
   • Date: Wed, 30 Oct 2019 07:46:43 GMT
   
   

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: fef99ca3-72bb-2c48-a62b-9ff9c314d72b
• Version Independent ID: e58fd3a1-0af8-6e16-3d78-3dc748992593
• Content: Microsoft identity platform and OAuth Authorization Code Flow
• Content Source: articles/active-directory/develop/v2-oauth2-auth-code-flow.md
• Service: active-directory
• Sub-service: develop
• GitHub Login: @rwike77
• Microsoft Alias: ryanwi

[shashishailaj]

@johnz Thank you for your feedback . We will investigate and update this thread further.

[mhenaghan]

Hi @shashishailaj do you have any update on this?

[luxliu]

@shashishailaj We got this issue as well and can't release the new feature based on it. Thanks for the help.

[gregster14]

Thanks for raising this John, looks like it will be a problem for my team too. Appreciate updates on this @shashishailaj

[nads400]

Please help @shashishailaj we have this problem too. can you please advise the expected time of resolution?

[amanmcse]

Hello @johnz,

Thanks for reaching out.

I tracked the request based on the request ID that you shared and I found that the application is a multitenant app and user from a different tenant is trying to access the application. I have tried to replicate the issue that you shared at my end but I was successfully able to get all the scopes mentioned in the request.

1. Registered application in {tenant1} and specified the App ID in below request for authorization code. I have replaced {tenantID} with common to allow home tenant discovery based on the UPN suffix of the user.
   https://login.microsoftonline.com/**common**/oauth2/v2.0/authorize?client_id=98eb0e86-xxxx-xxxx-xxxx-f999e3828b75&response_type=code&redirect_uri=https://jwt.ms&response_mode=query&scope=offline_access+User.Read.All+Reports.Read.All+AuditLog.Read.All+Directory.Read.All+SecurityEvents.Read.All
2. Accepted the consent prompt and copied the CODE for next call:
   
3. Made an access and refresh token request with below parameters including CODE from previous step and confirmed all the requested scopes are present in the access token.
   POST https://login.microsoftonline.com/{tenant2}.onmicrosoft.com/oauth2/v2.0/token

grant_type:authorization_code
code:OAQABAAIAAACQ....
client_id:98eb0e86-xxxx-xxxx-xxxx-f999e3828b75
client_secret:**************
redirect_uri:https://jwt.ms

1. Finally, redeemed the Refresh token to get new access token by making below call and confirmed all requested scopes are present.
   POST https://login.microsoftonline.com/{tenant2}.onmicrosoft.com/oauth2/v2.0/token

grant_type:refresh_token
refresh_token:OAQABAAAAAACAA.....
client_id:98eb0e86-xxxx-xxxx-xxxx-f999e3828b75
client_secret:**************
response_type:token

I tested by including Scopes in the request body as well and received all scopes in the token:

grant_type:refresh_token
refresh_token:OAQABAAAAAACAA.....
client_id:98eb0e86-xxxx-xxxx-xxxx-f999e3828b75
client_secret:**************
response_type:token
scope:profile openid email User.Read.All Reports.Read.All Directory.Read.All

I also tried to replicate the issue with user from same tenant where the application is registered and didn't encounter any issues with missing scopes in the token.

Could you please try these steps again and let me know if you are still facing this issue.

[johnz]

@amanmcse yes, this is a multi tenant app, we are trying to support different way to connect to the app. The scenario doesn’t work is:

App registered in tenant1,
Partner center admin from tenant2 try to access his customer - tenant3 data using the app

In this case Customer(tenant3) delegate administration privileges to partners(tenant2).
https://docs.microsoft.com/en-us/partner-center/customers_revoke_admin_privileges

In the login step we specify tenant3 id in the login url and use tenant2 account to login

if decode the access token should see idp(identity provider)
"idp": "https://sts.windows.net/{tenant2}/"
"tid": "{tenant3}"

[shashishailaj]

@johnz As per what you have mentioned, I have some doubts about the technical feasibility of your request . And hence this may need deep troubleshooting to assess the same . Please send us an email on azcommunity[at]microsoft[dot]com and we will help you with alternate support options to see the feasibility of the same. We will close this issue for now and will continue to work with you offline on this . Please do send us an email and we will continue this further.

Thank you.