Issue when creating OBO token

[q-benwillis]

Hi,

We're getting the following error when trying to get an OBO token using the users access token:
com.microsoft.aad.msal4j.MsalInteractionRequiredException: AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '00000009-0000-0000-c000-000000000000'. Trace ID: 2ddbec8a-5ba3-42e3-8137-7c05d3117100 Correlation ID: 4b3ea49c-96f2-4612-b509-ab3dbc9c57c7 Timestamp: 2024-09-27 15:23:03Z

We've attempted to solve this by propagating the error back to the front end and calling acquireAccessToken again but with claimsForConditionalAccessPolicy defined. We've been following the example here: https://github.com/microsoft/Microsoft-Fabric-workload-development-sample/pull/95/files

Unfortunately this doesn't seem to be working and we're seeing no difference in behaviour:

1. The first request is sent, the OBO token cannot be created and the response is returned with status 401 and a WWW-Authenticate header containing the claims from the error
2. The front end gets a new token setting claimsForConditionalAccessPolicy to the claims from the WWW-Authenticate header
3. We retry the request with the new token but get the exact same result

A few questions:

• We're using the MSAL for Java SDK which returns an MsalInteractionRequiredException instead of the MsalUiRequiredException, is this correct?
• The claims we get back looks like: {"access_token":{"capolids":{"essential":true,"values":["e61bc582-9773-4167-bd5c-d2bff32dec63"]}}}, is this correct?
• We can see this in the Azure console around the time, any idea what it means:
  

Any other guidance would be appreciated!

[ramizsha]

Hi @q-benwillis,

1. Yes that is the right exception.
2. The claims string looks like the right format.
3. In what console do you see this? in the browsers console in Fabric?
   Also, do you see any popup window when passing the claims as claimsForConditionalAccessPolicy?

[q-benwillis]

Hmm I think something has changed, I'm now getting an MsalInteractionRequiredException with claims null and reason "CONSENT_REQUIRED". Do you know what I'm supposed to do with this?

Looking at some of the old tokens I have, none of them have mfa or amr claims.

[ramizsha]

Yes, you should populate the error the same way alongside the scope you tried to exchange the token for and call the JS API with additionalScopesToConsent and you should see a popup window asking you to consent.

By the way - are you by any chance working with a guest user on the tenant?

[q-benwillis]

Okay this makes sense, we should be calling with .default when you first load the application but maybe the scopes defined in the enterprise application don't align with the scopes we're trying to exchange the token for, I will check that.

Yes we are, I have now implemented your suggestion from the other thread. I think I need to bring all these changes together and test them at once, will let you know once I've done that. Thanks for your help.

[ramizsha]

This might be the issue, our sample does not fully support B2B scenarios at the moment.
I have created a PR to fix this, please refer to it and change your code accordingly: #115

Another thing, if you're working dynamically with scopes and not configuring them on your entra Id application, you will need to ask for a consent for specific scopes and not use the .default scope:
For example, if you want to ask for a token for "https://analysis.windows.net/powerbi/api/Item.Read.All" and you don't have it configured on your application, you must ask for a consent for "https://analysis.windows.net/powerbi/api/Item.Read.All" and not "https://analysis.windows.net/powerbi/api/.default".

[q-benwillis]

Yes, it ended up being a combination of these three things. Once we implemented the claimsForConditionalAccessPolicy flow, added the tenant id to the obo request and updated the scopes on our entra id application everything worked as expected. Thanks again for your help!