Issues using token to access "/workspaces" API

[tjroberts]

We are hitting issues calling the https://api.fabric.microsoft.com/v1/admin/workspaces API using the OBO flow detailed in the discussion below.
#89

With the above strategy we get a 403 when trying to access the API.

We originally thought this was because the Tenant.Read.All permission is missing from the user token. We have it on the app registration we are using but that doesn't seem to be carrying through to the user. Once we explicitly added the scopes we get the error below.

{'error': 'invalid_grant', 'error_description': "AADSTS65001: The user or administrator has not consented to use the application with ID '<application-id>' named '<application name>'. Send an interactive authorization request for this user and resource. Trace ID: e8ccadfc-262d-4b72-bef4-a1d05b6d3700 Correlation ID: 84b3ac07-b142-4c09-9445-502aad6def90 Timestamp: 2024-09-12 21:43:56Z", 'error_codes': [65001], 'timestamp': '2024-09-12 21:43:56Z', 'trace_id': 'e8ccadfc-262d-4b72-bef4-a1d05b6d3700', 'correlation_id': '84b3ac07-b142-4c09-9445-502aad6def90', 'suberror': 'consent_required'}

Researching this error we found this thread and tried some of the things:
https://learn.microsoft.com/en-us/answers/questions/545439/aadsts65001-the-user-or-administrator-has-not-cons

Even after this we are getting a similar error:

{'error': 'invalid_grant', 'error_description': "AADSTS65001: The user or administrator has not consented to use the application with ID '8c477649-821f-4d62-90eb-f19b7feda64a' named '<app-id>'. Send an interactive authorization request for this user and resource. Trace ID: 225c60c9-97b3-408f-b9e0-a61bc81f5400 Correlation ID: 343cc54d-e65c-4171-88aa-f3bf8adf4430 Timestamp: 2024-09-13 17:24:25Z", 'error_codes': [65001], 'timestamp': '2024-09-13 17:24:25Z', 'trace_id': '225c60c9-97b3-408f-b9e0-a61bc81f5400', 'correlation_id': '343cc54d-e65c-4171-88aa-f3bf8adf4430', 'suberror': 'consent_required'}

I'm attaching an image of our app registration permissions.

Most of our other API's are working but we are getting consistent problems getting /workspaces to work. This call is coming from our Fabric back-end. How should we handling this case so that we can take the user token and authorize our backend to access this API on their behalf?

[ramizsha]

Hi @tjroberts,
This is happening because the user did not consent for your application to access this scope (as the error suggests).
To get a user consent, your workload must propagate the error to the client and ask for a consent for this scope.
Here's how consents work with the javascript API:

• If the user did not grant any consent previosuly to the application, he will recieve a popup window with all the static dependencies you configured on your application when the workload asks for a token using the JS API.
• If the user already granted consent and you add a new dependency on your application, it will not trigger automatically, you must propogate the error you see when your try to exchange the token to the client and ask for a consent using the JS API and provide the scope you want the user to consent for in the additionalScopesToConsent parameter.
  Please refer to this PR for reference on how to propagate errors from the workload backend to the workload frontend when working with CRUD/jobs: [Authentication] - propagate errors to the client and handle them #95

[ramizsha]

Oh I just noticed that you are using the admin API.
You can take a look at the token you are creating and see if it includes the requried scope to call this API.
Also please note that there are permissions required as well: https://learn.microsoft.com/en-us/rest/api/fabric/admin/workspaces/list-workspaces?tabs=HTTP#permissions

[box-turtle]

We switched to the non-admin workspaces API.

I added https://analysis.windows.net/powerbi/api/Workspace.Read.All to the list of scopes to consent when calling acquireAccessToken. This causes the popup to flash open but no form to consent is displayed.

I'm still getting a 401 error:

{'error': 'invalid_grant', 'error_description': "AADSTS65001: The user or administrator has not consented to use the application with ID '8c477649-821f-4d62-90eb-f19b7feda64a' named 'Teradata AI Unlimited Dev'. Send an interactive authorization request for this user and resource. Trace ID: 6c29a390-4a12-4e3c-a7e4-ee624e4c1300 Correlation ID: 7cd43caf-42c0-41f6-92de-fbeff7fa1cd6 Timestamp: 2024-09-16 21:24:02Z", 'error_codes': [65001], 'timestamp': '2024-09-16 21:24:02Z', 'trace_id': '6c29a390-4a12-4e3c-a7e4-ee624e4c1300', 'correlation_id': '7cd43caf-42c0-41f6-92de-fbeff7fa1cd6', 'suberror': 'consent_required'}

these are the scopes included in the token on the call

  "scp": "FabricLakehouse.Read.All FabricLakehouse.ReadWrite.All Item1.Read.All Item1.ReadWrite.All Lakehouse.ReadWrite.All Tenant.Read.All Workspace.Read.All",

All of these scopes have been granted admin consent:

This error comes when using any id from our corp directory. We have an admin user created in the dev tenant where we are testing this and the call works for that user. All the corp users are added as "guests" in the dev tenant - could this be the source of our problem?

[ramizsha]

@box-turtle I think theres some confusion here - I thought you managed to exchange the token but failed on the API call itself, and when I asked to check for the scopes inside the token, I was referring to the exchanged token and not the workload token.

Let me see If I get this straight:
You want to call the non admin workspace API for a specific user "x" that is not a part of the tenant you granted a consent for, and you are trying to exchange the token but are failing with the error you mentioned above - is that the case?

If so, you need to propagate an error to the client saying that you need to consent for that scope. and user "x" (or his tenant admin) must consent for your application to access the required scope.
Again, you can request a consent for that scope using the javascript API and providing aditional scopes to consent:
workloadClient.auth.acquireAccessToken({ additionalScopesToConsent: ["https://analysis.windows.net/powerbi/api/Workspace.Read.All"]})
Alternativly, you can call workloadClient.auth.acquireAccessToken({promptFullConsent: true}) which will show a consent for all the static dependencies on the application regardless whether the user consented on some of them or not.

[box-turtle]

You want to call the non admin workspace API for a specific user "x" that is not a part of the tenant you granted a consent for, and you are trying to exchange the token but are failing with the error you mentioned above - is that the case?

yes

What I am trying to say is I am using the Javascript API and making the exact call you are suggesting, but that only flashes the consent window for less than a second and does not display a form for the user to actually consent. The token is returned and I send that to our BE service where the error I included gets generated. Requesting the additional scope to consent does not solve our issue.

Alternativly, you can call workloadClient.auth.acquireAccessToken({promptFullConsent: true}) which will show a consent for all the static dependencies on the application regardless whether the user consented on some of them or not.

Is that a valid argument for acquireAccessToken ? I am using

    "@ms-fabric/workload-client": "^2.0.0",

But the type of AcquireAccessTokenParms does not include promptFullConsent as a valid param?

interface AcquireAccessTokenParams {
    additionalScopesToConsent?: string[];
    claimsForConditionalAccessPolicy?: string;
}

[ramizsha]

@box-turtle The behavior of the consent window opening and closing immedietly may indicate 2 possible scenarios:

1. The user has already consented to the specified scope.
2. Theres an error and the user cannot consent on that scope.

You can see what is happening here: https://github.com/microsoft/Microsoft-Fabric-workload-development-sample/blob/main/Frontend/src/index.ts

This is the code that closes the window, you can remove the paths that close the window temporarily and re-call the JS API and see what is happening there:

1. If the url that appears in the window has "code=..." it means that the user has already consented.
2. If the url that appears in the window has "error", it means there's some error in the flow (you can see the message in the url as well).

Please note that we do have code to handle simple error cases in the file I mentioned and you can expand it/modify it as you wish.

Regarding "promptFullConsent" parameter, it became available as of 2.0.2 if I'm not mistaken.

[box-turtle]

Thanks for the tip about upgrading Fabric client. When I added promptFullConsent I get this popup:

I submitted the request but I don't know where that request goes?

[box-turtle]

I'm assuming our problem is that our user is defined in tenant A and the app registration is in tenant B - which must be a common scenario.

We have switched to using the regular workspaces api, not the admin one, and adjusted the permission accordingly. But we are still getting this error:

{'error': 'invalid_grant', 'error_description': "AADSTS65001: The user or administrator has not consented to use the application with ID '8c477649-821f-4d62-90eb-f19b7feda64a' named 'Teradata AI Unlimited Dev'. Send an interactive authorization request for this user and resource. Trace ID: 2e8d9f4c-8383-45fd-b135-4a47f9304100 Correlation ID: d353188d-4aec-4b75-b556-2dbf2721f32d Timestamp: 2024-09-18 15:42:57Z", 'error_codes': [65001], 'timestamp': '2024-09-18 15:42:57Z', 'trace_id': '2e8d9f4c-8383-45fd-b135-4a47f9304100', 'correlation_id': 'd353188d-4aec-4b75-b556-2dbf2721f32d', 'suberror': 'consent_required'}

When the consent popup appears, it asks me enter the reason I need access, but we don't know WHERE that requests goes or where in the Azure UI the admin of tenant A would go to see such a request and approve it.

Since the app registration does not reside in Tenant A - do we need the Tenant A admin to follow this procedure:

https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent?pivots=portal#construct-the-url-for-granting-tenant-wide-admin-consent

If this is what needs to happen - are we going to have to get every one of our customers to do this when they try to use our workload?

[box-turtle]

Ah - we got our Azure admin to read over this discussion and he knew where to consent to these requests. I think we are good now.

[box-turtle]

So unfortunately approving/consenting did not resolve our 401 issue...

Our admin approved the request as shown above.

I request the additional scope to consent when getting the token - the popup appears/disappears with no error in the url.

and yet still the error on the BE is

 {'error': 'invalid_grant', 'error_description': "AADSTS65001: The user or administrator has not consented to use the application with ID '8c477649-821f-4d62-90eb-f19b7feda64a' named 'Teradata AI Unlimited Dev'. Send an interactive authorization request for this user and resource. Trace ID: 70674bd3-6953-465d-b120-95f964fd1c00 Correlation ID: b9af66a8-5e8b-43e3-9baa-af7cf15d59db Timestamp: 2024-09-18 18:50:11Z", 'error_codes': [65001], 'timestamp': '2024-09-18 18:50:11Z', 'trace_id': '70674bd3-6953-465d-b120-95f964fd1c00', 'correlation_id': 'b9af66a8-5e8b-43e3-9baa-af7cf15d59db', 'suberror': 'consent_required'}

scopes in the token:

 "scp": "FabricLakehouse.Read.All FabricLakehouse.ReadWrite.All Item1.Read.All Item1.ReadWrite.All Lakehouse.ReadWrite.All Workspace.Read.All",

this is for a user that is a guest in the tenant - a user defined in the tenant does not give this error.

The other part that is puzzling is that the /workspaces API is the only one that has this issue - all the other calls to read/write from a Lakehouse work fine for the guest user.

[ramizsha]

@box-turtle Oh, this is happening because you are using /organizations in the authority.
To solve this you can do 1 of two things:

1. Configure your authority to use "/tenantId" but with the tenant id that's recieved in the token ("tid") claim (and not your own tenant).
2. You can configure your authority with /organizations but specify the tenant id in the call itself (for example in c# you can use WithTenantId - something like await confidentialClientApplicationBuilder.AcquireTokenOnBehalfOf(new List<string> { scope }, assertion).WithTenantId("The tenant id in the token").ExecuteAsync();

[box-turtle]

Thanks @ramizsha - we will give that a try!