AADSTS50001 - Specify resource_id in www-authenticate response header?

[Phil0001]

We are connecting to an API to get data.

Authentication is via AAD and this is working successfully since we added the www-authenticate response header identifying the authorization url:

e.g.

WWW-Authenticate: Bearer authorization_uri=https://login.microsoftonline.com/xyz/oauth2/authorize

However, we then get the AADSTS50001 error "The application named X was not found in the tenant named Y". In fact the resource we are targetting *does* exist, it is just named differently. (The AAD application name does not match the API endpoint domain name as seems to be expected\assumed).

If we create an AAD application with the assumed name (https://api.xxx.co.nz) we can get it to work and return data, but that's just a cumbersome workaround.

Can we specify the resource_id in the www-authenticate response header along with the authorization_uri, something like this:

Bearer authorization_uri=https://login.microsoftonline.com/xyz/oauth2/authorize, resource_id=https://xxx.dev.yyy.co.nz

[albertino87]

Has this been fixed?
I think I have the same problem, i would like to use the microsoft Graph client id as resource_id but i think it hardcodes localhost:5000

[Anonymous]

Hi, All,

I have similar problem. Is there any solution to it?

Thanks.

[Anonymous]

Hey, 
I have the same problem, somebody resolve this problem?

Cheers,

M

[Eric_Zhang]

---

@Phil0001 wrote:

We are connecting to an API to get data.

Authentication is via AAD and this is working successfully since we added the www-authenticate response header identifying the authorization url:

e.g.

WWW-Authenticate: Bearer authorization_uri=https://login.microsoftonline.com/xyz/oauth2/authorize

However, we then get the AADSTS50001 error "The application named X was not found in the tenant named Y". In fact the resource we are targetting *does* exist, it is just named differently. (The AAD application name does not match the API endpoint domain name as seems to be expected\assumed).

If we create an AAD application with the assumed name (https://api.xxx.co.nz) we can get it to work and return data, but that's just a cumbersome workaround.

Can we specify the resource_id in the www-authenticate response header along with the authorization_uri, something like this:

Bearer authorization_uri=https://login.microsoftonline.com/xyz/oauth2/authorize, resource_id=https://xxx.dev.yyy.co.nz

---

@Phil0001

What API is connected to get data? You description is confusing as it seems to have nothing to do with Power BI. Since your question is more related to Azure AD, for better response, I'd suggest you post in the dedicated Azure AD forum.

[Phil0001]

@Eric_Zhang

Hi,
It is related to Power BI Desktop accessing an OAuth protected API but seemingly providing no way for us to specify the OAuth resource.

We can get authentication working by sending the authorization_url in the www-authenticate response header, but we cannot specify the OAuth resource to target so accessing the API ultimately fails after authentication.

We have no trouble with AAD generally but when accessing our API's through Power BI Desktop we have a lot of trouble, hence my question is here!

So,
I have captured in Fiddler the request sent by pbidesktop.exe to login.microsoftonline.com. As you can see the 'resource' is hardcoded as the API we are accessing. (I've separated parameters for clarity). This 'resource' is not correct and is what is causing the issue.

To reiterate, this is POWER BI crafting this HTTP request and sending it to the specified authorization_url but also adding a few parameters of it's own, some of which we really need to specify somehow - 'resource':
 
GET https://login.microsoftonline.com/dev2.onmicrosoft.com/oauth2/authorize
?state=9d21fd
&display=popup
&client_id=a672
&redirect_uri=https://de-users-preview.sqlazurelabs.com
&resource=https://myapi.dev.domain.co.nz <----WRONG, BUT WE CANNOT CHANGE?
&response_type=code
&prompt=select_account
&scope=user_impersonation
&mkt=en-US

How do we specify to Power BI the actual OAuth 'resource' we are targetting - either through the UI for accessing web data, or in the www-authenticate response header we send from our API?

e.g.

www-authenticate: Bearer authorization_uri=https://login.microsoftonline.com/xyz/oauth2/authorize, resource_id=https://xxx.dev.yyy.co.nz

[Phil0001]

@Eric_Zhang

got any ideas?

Ta

[lars_k]

@Phil0001 Were you ever able to get this working?
@Eric_Zhang I have the same problem. We could really use some help here! Thanks!