EWS: "Remote server responded to error (401)" Unauthorized "

Question

I am trying to find one element for all elements in the current context, but I seem to constantly get this error message:

Request failed. The remote server returned an error: (401) Unauthorized.

First, I installed everything to access the exchange service:

var signInUserId = ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value; var userObjectId = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier").Value; AuthenticationResult authenticationResult = null; AuthenticationContext authenticationContext = new AuthenticationContext( SettingsHelper.Authority, new model.ADALTokenCache(signInUserId)); authenticationResult = authenticationContext.AcquireToken( SettingsHelper.ServerName, new ClientCredential(SettingsHelper.ClientId, SettingsHelper.ClientSecret)); ExchangeService exchange = new ExchangeService(ExchangeVersion.Exchange2013); exchange.Url = new Uri(SettingsHelper.ServerName + "ews/exchange.asmx"); exchange.TraceEnabled = true; exchange.TraceFlags = TraceFlags.All; exchange.Credentials = new OAuthCredentials(authenticationResult.AccessToken); 

And then I determine which element I want to get (by ID):

 ItemView view = new ItemView(5); view.PropertySet = new PropertySet(BasePropertySet.IdOnly); var tempId = id.Replace('-', '/').Replace('_', '+'); SearchFilter.IsEqualTo searchid = new SearchFilter.IsEqualTo(ItemSchema.Id, tempId); 

And last but not least, I'm trying to search for this element in my elements:

 FindItemsResults<Microsoft.Exchange.WebServices.Data.Item> results = exchange.FindItems(WellKnownFolderName.Inbox, searchid, view); 

And here is my mistake. I tried other ways to do this, but no matter what I do, I get unauthorized access.

Can someone possibly guide me correctly to solve this problem?

EDIT

I get an access token from:

 authenticationResult = authenticationContext.AcquireToken( SettingsHelper.ServerName, new ClientCredential(SettingsHelper.ClientId, SettingsHelper.ClientSecret)); 

as I see it, debugging the code.

There is no update token, although I do not know if it has anything to say?

EDIT

I just managed to completely debug all the way in exchange.ResponseHeaders , where I saw this:

An access token is acquired using an authentication method that is too weak to provide access for this application. Submitted by auth force equal to 1, required 2

I decrypted the JWT since this is my result:

 { typ: "JWT", alg: "RS256", x5t: "MnC_VZcATfM5pOYiJHMba9goEKY", kid: "MnC_VZcATfM5pOYiJHMba9goEKY" }. { aud: "https://outlook.office365.com/", iss: "https://sts.windows.net/d35f5b06-f051-458d-92cc-2b8096b4b78b/", iat: 1445416753, nbf: 1445416753, exp: 1445420653, ver: "1.0", tid: "d35f5b06-f051-458d-92cc-2b8096b4b78b", oid: "c5da9088-987d-463f-a730-2706f23f3cc6", sub: "c5da9088-987d-463f-a730-2706f23f3cc6", idp: "https://sts.windows.net/d35f5b06-f051-458d-92cc-2b8096b4b78b/", appid: "70af108f-5c8c-4ee4-a40f-ab0b6f5922e0", appidacr: "1" }. [signature] 

Where to go from here?

Answer 1

I already got this error when using EWS in the past "The access token was obtained using an authentication method that is too weak to allow access for this application. The presented authentication strength is 1, it takes 2"

What you need to do is provide certificate authentication.

 AuthenticationContext authContext = new AuthenticationContext(authority); exchangeService.Credentials = new OAuthCredentials(authContext.AcquireToken("https://outlook.office365.com", new ClientAssertionCertificate(ConfigurationManager.AppSettings["ida:ClientId"], certificate)).AccessToken); 

The key part is defining the new ClientAssertionCertificate as ClientAssertion.

You will also have to change the manifest of your Azure Active Directory application.

Take a look at this link (part of “Configuring a public X.509 certificate for your application”): https://msdn.microsoft.com/en-us/office/office365/howto/building-service-apps-in-office-365