Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Find everything you need to get certified on Fabric—skills challenges, live sessions, exam prep, role guidance, and more. Get started

Reply
Phil0001
Regular Visitor

AADSTS50001 - Specify resource_id in www-authenticate response header?

We are connecting to an API to get data.

 

Authentication is via AAD and this is working successfully since we added the www-authenticate response header identifying the authorization url:

e.g.

WWW-Authenticate: Bearer authorization_uri=https://login.microsoftonline.com/xyz/oauth2/authorize

 

However, we then get the AADSTS50001 error "The application named X was not found in the tenant named Y". In fact the resource we are targetting *does* exist, it is just named differently. (The AAD application name does not match the API endpoint domain name as seems to be expected\assumed).

 

If we create an AAD application with the assumed name (https://api.xxx.co.nz) we can get it to work and return data, but that's just a cumbersome workaround.

 

Can we specify the resource_id in the www-authenticate response header along with the authorization_uri, something like this:

 

Bearer authorization_uri=https://login.microsoftonline.com/xyz/oauth2/authorize, resource_id=https://xxx.dev.yyy.co.nz

 

 

7 REPLIES 7
albertino87
New Member

Has this been fixed?
I think I have the same problem, i would like to use the microsoft Graph client id as resource_id but i think it hardcodes localhost:5000

Anonymous
Not applicable

Hi, All,

 

I have similar problem. Is there any solution to it?

 

Thanks.

Anonymous
Not applicable

Hey, 
I have the same problem, somebody resolve this problem?

 

Cheers,

M

Eric_Zhang
Microsoft Employee
Microsoft Employee


@Phil0001 wrote:

We are connecting to an API to get data.

 

Authentication is via AAD and this is working successfully since we added the www-authenticate response header identifying the authorization url:

e.g.

WWW-Authenticate: Bearer authorization_uri=https://login.microsoftonline.com/xyz/oauth2/authorize

 

However, we then get the AADSTS50001 error "The application named X was not found in the tenant named Y". In fact the resource we are targetting *does* exist, it is just named differently. (The AAD application name does not match the API endpoint domain name as seems to be expected\assumed).

 

If we create an AAD application with the assumed name (https://api.xxx.co.nz) we can get it to work and return data, but that's just a cumbersome workaround.

 

Can we specify the resource_id in the www-authenticate response header along with the authorization_uri, something like this:

 

Bearer authorization_uri=https://login.microsoftonline.com/xyz/oauth2/authorize, resource_id=https://xxx.dev.yyy.co.nz

 

 


@Phil0001

What API is connected to get data? You description is confusing as it seems to have nothing to do with Power BI. Since your question is more related to Azure AD, for better response, I'd suggest you post in the dedicated Azure AD forum.

@Eric_Zhang

Hi,
It is related to Power BI Desktop accessing an OAuth protected API but seemingly providing no way for us to specify the OAuth resource.

 

We can get authentication working by sending the authorization_url in the www-authenticate response header, but we cannot specify the OAuth resource to target so accessing the API ultimately fails after authentication.

 

We have no trouble with AAD generally but when accessing our API's through Power BI Desktop we have a lot of trouble, hence my question is here!

 

So,
I have captured in Fiddler the request sent by pbidesktop.exe to login.microsoftonline.com. As you can see the 'resource' is hardcoded as the API we are accessing. (I've separated parameters for clarity). This 'resource' is not correct and is what is causing the issue.

To reiterate, this is POWER BI crafting this HTTP request and sending it to the specified authorization_url but also adding a few parameters of it's own, some of which we really need to specify somehow - 'resource':
 
GET https://login.microsoftonline.com/dev2.onmicrosoft.com/oauth2/authorize
?state=9d21fd
&display=popup
&client_id=a672
&redirect_uri=https://de-users-preview.sqlazurelabs.com
&resource=https://myapi.dev.domain.co.nz <----WRONG, BUT WE CANNOT CHANGE?
&response_type=code
&prompt=select_account
&scope=user_impersonation
&mkt=en-US

 

How do we specify to Power BI the actual OAuth 'resource' we are targetting - either through the UI for accessing web data, or in the www-authenticate response header we send from our API?

 

e.g.

www-authenticate: Bearer authorization_uri=https://login.microsoftonline.com/xyz/oauth2/authorize, resource_id=https://xxx.dev.yyy.co.nz

 

 

 

@Eric_Zhang

got any ideas?

 

Ta

 

@Phil0001 Were you ever able to get this working?
@Eric_Zhang I have the same problem. We could really use some help here! Thanks!

Helpful resources

Announcements
Sept PBI Carousel

Power BI Monthly Update - September 2024

Check out the September 2024 Power BI update to learn about new features.

September Hackathon Carousel

Microsoft Fabric & AI Learning Hackathon

Learn from experts, get hands-on experience, and win awesome prizes.

Sept NL Carousel

Fabric Community Update - September 2024

Find out what's new and trending in the Fabric Community.