Microsoft Azure - OAuth2 - "invalid_request"

Question

I would like to connect my app with Microsoft Graph. I created my web-app in Azure (I have my client_id and client_secret). I am able to send a request to get the authorization code from https://login.microsoftonline.com/common/oauth2/v2.0/authorize.

The problem is that when I send a POST request in order to get the acess token from https://login.microsoftonline.com/common/oauth2/v2.0/token (exactly like said here in the "Using permissions" section) using Postman (with form-data option), I get an "AADSTS9000410: Malformed JSON" error:

{
  "error": "invalid_request",
  "error_description": "AADSTS9000410: Malformed JSON.\r\nTrace ID: f5c1dd4b-ad43-4265-91cb-1b7392360301\r\nCorrelation ID: 1dea54ed-bb43-4951-bc9e-001877fe427b\r\nTimestamp: 2019-01-14 21:38:42Z",
  "error_codes": [9000410],
  "timestamp": "2019-01-14 21:38:42Z",
  "trace_id": "f5c1dd4b-ad43-4265-91cb-1b7392360401",
  "correlation_id": "1dea54ed-bb43-4951-bc9e-001878fe427b"
}

Moreover, when I send the same request with a raw option in Postman, I get "AADSTS900144: The request body must contain the following parameter: 'grant_type'":

 {
  "error": "invalid_request",
  "error_description": "AADSTS900144: The request body must contain the following parameter: 'grant_type'.\r\nTrace ID:a7c2f8f4-1510-42e6-b15e-b0df0865ff00\r\nCorrelation ID:e863cfa9-0bce-473c-bdf6-e48cfe2356e4\r\nTimestamp: 2019-01-1421:51:29Z",
  "error_codes": [900144],
  "timestamp": "2019-01-14 21:51:29Z",
  "trace_id": "a7c2f8f4-1510-42e6-b15e-b0df0865ff10",
  "correlation_id": "e863cfa9-0bce-473c-bdf6-e48cfe2356e3"
}

However, when I remove application/json in my header in Postman, and I put x-www-form-urlencoded option, everything looks fine.

I can only send POST requests with a JSON format in my application.

Does Microsoft Graph support JSON format for POST requests?

Is it a Postman issue?

Answer 1

I ran into a similar issue, but realized that there was a mismatch between the Content-Type: application/x-www-form-urlencoded header and the JSON-formatted request body. If you refer to this documentation, you'll see that the request body needs to be URL encoded (concatenated with ampersands, encoded entities, etc.), which ultimately resolved my issue. So, I don't believe this is an issue with Postman or MS APIs but, rather, just incorrect formatting of your request body.

I'm not sure what language your app uses, but here's an example using Node and Express that works for me:

const fetch = require('node-fetch')
const { URLSearchParams } = require('url')

async function getAccessToken(req, res, next) {
  try {
    const response = await fetch('https://login.microsoftonline.com/common/oauth2/v2.0/token', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/x-www-form-urlencoded'
      },
      // Previously I was doing `body: JSON.stringify({...})`, but
      // JSON !== URL encoded. Using `URLSearchParams` (or whatever
      // the equivalent is in your language) is the key to success.
      body: new URLSearchParams({
        client_id: YOUR_CLIENT_ID_HERE,
        scope: 'User.Read Calendars.Read',
        redirect_uri: YOUR_REDIRECT_URL_HERE,
        grant_type: 'authorization_code',
        client_secret: YOUR_CLIENT_SECRET_HERE,
        code: req.query.code
      }
    })
    const json = await response.json()
    // `json` will have `access_token` and other properties
  } catch (err) {
    throw err
  }
}

Hope that helps!