InvalidAuthenticationToken - CompactToken parsing error with error code: -2147184105

Question

I am using V1 to have a token from the Microsoft REST API. (We have an Office 365 tenant, and I used to successfully get all the resources without any problems, but nothing more.

clientId =8a67......de4b6 clientSecret =J58k8....5EU= redirectUri =http://example.com... resourceUrl =https://graph.microsoft.com authority = https://login.microsoftonline.com/f02633....a603/oauth2/token 

https://login.microsoftonline.com/f0263...0be3/oauth2/authorize?client_id=8a6..b6&redirect_uri=http://example.com&response_type=code&scope=mail.read

He gave me a token, structured properly on the JWT . He says an invalid signature, but is not sure what is wrong.

As soon as I have a token, I tried the following curl call

 curl -i https://graph.microsoft.com/v1.0/me/messages -H 'Content-Type: application/x-www-form-urlencoded' -H 'Authorization: Barer eyJ.[TOKEN]...UNa6nfw' 

Instead of messages, I received the following error:

 HTTP/1.1 401 Unauthorized Content-Type: application/json; charset=utf-8Cl23 Server: Microsoft-IIS/8.5 request-id: af2390b1-a9b...5ab9 client-request-id: af2390,....a615ab9 x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"West US","Slice":"SliceA","ScaleUnit":"000","Host":"AGSFE_IN_4","ADSiteName":"WST"}} X-Powered-By: ASP.NET Date: Thu, 19 Jan 2017 23:55:43 GMT Content-Length: 268 { "error": { "code": "InvalidAuthenticationToken", "message": "CompactToken parsing failed with error code: -2147184105", "innerError": { "request-id": "af2390b1-...5ab9", "date": "2017-01-19T23:55:44" } } } 

I looked at similar questions on SO, but did not find any solution.

Answer 1

First, the Barer authorization header is a typo. The correct parameter should be like authorization: bearer {access_token} .

Secondly, it seems that you were mixing using the Azure V1.0 endpoint and V2.0 endpoint. If you were developing with the V1.0 endpoint, which applications were protected from Azure portals, when we purchase an access token, we need to specify the resource parameter instead of the scope .

The scope parameter is used for the Azure V2.0 endpoint, which applications cannot find here . p>

And the authorization endpoint for Azure AD is like below:

V1.0:

 https://login.microsoftonline.com/{tenant}/oauth2/authorize 

V2.0:

 https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize? 

For more information on the code flow with Azure AD, you can refer to the links below:

Allow access to web applications using OAuth 2.0 and Azure Active Directory

v2.0 Protocols - OAuth 2.0 Code Authorization Stream