You may encounter script errors with the background text saying cookies are disabled when running MSAL code snippet similar to the following in a XAML Browser Application (XBAP) from Internet Explorer when performing Azure AD login Root Cause XBAP Applications, although housed in Internet Explorer, runs in its own process space: PresentationHost.exe, which is a very tightly-controlled security container. XBAP Application uses the webBrowser control to host the Azure AD…
Read MoreHow to use an access token to connect to an Azure SQL Database
In Azure SQL, an access token can be used to authenticate a user or service principal. In this blog post, I will show you what is required for both and give some methods for acquiring the access token based on the scenario to set the access token parameter in the connection object. Requirements: You have an Azure tenant and an Azure SQL database already configured and basic understanding of SSMS…
Read MoreUpdate Asp.Net or Asp.Net Core app session to last longer than Azure AD tokens
Azure AD tokens (ID tokens, access tokens, and SAML tokens) by default last one hour. Asp.Net and Asp.Net Core Middleware sets their authentication ticket to the expiration of these tokens by default. If you do not want your web application to kick the user out redirecting them to Azure AD to sign-in again, you can customize the Middleware authentication ticket. This can also help resolve AJAX issues (getting CORS error…
Read MoreUsing MSAL in a VB.Net Winforms application
All of our MSAL samples are for either Web, mobile client or console applications in c#. This blog post will show how you can also use MSAL in vb.net in a Winforms desktop application. When creating a winforms application, the thing to remember is that code in your form will run under the UI thread, which, for the most part is ok. However, when MSAL prompts for credentials, it will…
Read MoreNetLog: Alternative to Fiddler and HAR captures
Have you run across where you can’t get a standard Fiddler capture, and furthermore, HAR captures from developer tools is truncating the information you need to see? I ran across the NetLog tool built into Chromium based browsers. So, this will work in the new Microsoft Edge, Chrome, and Electron. Here are couple known limitations before we get started… POST request bodies are not captured. Sites running in compatibility mode…
Read MoreReceiving error ‘Neither tenant is B2C or tenant doesn’t have premium license’ from Microsoft Graph
You may receive the following error ‘error’: { ‘code’: ‘Authentication_RequestFromNonPremiumTenantOrB2CTenant’, ‘message’: ‘Neither tenant is B2C or tenant doesn’t have premium license’, ‘innerError’: { ‘date’: ‘2021-03-04T07:53:51’, ‘request-id’: ‘a0a074e6-xxx-c511669fa420’, ‘client-request-id’: ‘a0a074e6-xxx-c511669fa420′ } when making any Microsoft Graph call querying users’ sign in activities, for example the following GET requests https://graph.microsoft.com/v1.0/auditLogs/signIns or https://graph.microsoft.com/beta/users?$select=displayName,userPrincipalName,signInActivity So what’s the resolution? The following criteria are required for the call to succeed: The queried tenant or directory will…
Read MoreAADSTS50000: There was an error issuing a token or an issue with our sign-in service
This error can occur during Azure AD authentication process or during any token acquisition flow using the token endpoint. There are multiple causes for this error to happen. Below are a few scenarios that can lead to the error . Root Cause 1: the user password is either expired, invalid, or out of sync This can happen more predominantly in a hybrid environment. The authenticated federated account’s password may be…
Read MoreUsing MSAL.js v2 in a SPA App to call a web API protected by Azure App Service’s Easy Auth with Azure AD
There are a couple of ways to call an Easy Auth enabled web API. You can either call the web API with: an Easy Auth session cookie (via a previously authenticated browser session to the web API) or An Azure AD Bearer JWT token In this post I will show you how to use MSAL.JS v2 in a Single Page Application (SPA) to get an access token for the web…
Read MoreRetry Invoke-RestMethod requests in PowerShell when an error occurs
In this blog post, I will show you how you can trap a specific type of error when making a graph request using the Invoke-RestMethod commandlet and pause and retry the request x number of times before quitting. This is very helpful and is actually recommended to do error handling when making requests to Microsoft Graph. The key here is to set the Url that you’re going to be calling…
Read MoreGetting Azure Key Vault secret with Azure.Identity and Azure.Security.KeyVault
In my last post, I talked about using ADAL (now deprecated) with the KeyVaultClient class to get an access token using OAuth2 Client Credentials Grant flow and query Azure Key Vault with that access token. In this post, I’ll talk about using a couple of new classes in the Azure SDK for .NET library to accomplish the same goal. We will use Azure.Identity name space for our Azure AD token…
Read More