Incorrect protocol url and scope prefix used for MSOffice365Protocol

[rayeeskm]

When using MSOffice365Protocol as the protocol, during authentication it always fails with error

Unable to fetch auth token. Error: (invalid_client) AADSTS700025: Client is public so neither 'client_assertion' nor 'client_secret' should be presented.

The issue was found to be the following

class MSOffice365Protocol(Protocol):
_protocol_url = 'https://outlook.office.com/api/'
_oauth_scope_prefix = 'https://outlook.office.com/'

After changing it to the following, it seems to work fine

_protocol_url = 'https://outlook.office365.com/api/'
_oauth_scope_prefix = 'https://outlook.office365.com/'

[alejcas]

See:

https://docs.microsoft.com/en-us/previous-versions/office/office-365-api/api/version-2.0/use-outlook-rest-api

Exactly this piece of text:

Regardless of the approach you use for app registration and user authorization, or whether your app targets Office 365 or Outlook.com mailbox data, the latest Outlook REST endpoint is in production and you can start using it in your REST API calls whenever you are ready:

https://outlook.office.com/api/{version}/{user_context}

The following Outlook REST endpoint will continue to work for a while for only Office 365 mailbox data:

https://outlook.office365.com/api/{version}/{user_context}

So the correct endpoint is outlook.office.com

Your problems seems related to the app configuration.

[rayeeskm]

We use office365 mailbox. I checked again. Contrary to whats mentioned in the doc, the other endpoint doesn't seem to work for office365 mailbox.

[alejcas]

I also use office 365 and the endpoint: https://outlook.office.com/ is working as expected.

[Narcolapser]

I'm experiencing the same issue. I'll see if I can figure it out in more depth.

[Narcolapser]

ok, this appears to be part of it, set your client type to treat as public. I did that but it hasn't resolved the issue yet. But we have a very strange hybrid cloud here so I'm trying to pin down if that didn't resolve the issue just for me. @rayeeskm, can you try this?

[Narcolapser]

So if you remove this line (reformatting parens of course) it seems to work. I'm going to look at the docs a little deeper and see if we should set this as a toggle or something.

[Narcolapser]

Ok, yes, that part needs to be optional, see here:

// Line breaks for legibility only

POST /common/oauth2/v2.0/token HTTP/1.1
Host: https://login.microsoftonline.com
Content-Type: application/x-www-form-urlencoded

client_id=6731de76-14a6-49ae-97bc-6eba6914391e
&scope=user.read%20mail.read
&code=OAAABAAAAiL9Kn2Z27UubvWFPbm0gLWQJVzCTE9UkP3pSx1aXxUjq3n8b2JRLk4OxVXr...
&redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F
&grant_type=authorization_code
&client_secret=JqQX2PNo9bpM0uEihUPzyrh    // NOTE: Only required for web apps

I'll make a patch.

[Narcolapser]

I've pushed a new commit, @rayeeskm give my changes a try. You'll need to specify that your application is a native app:

account.authenticate(scopes=scopes,native=True)

[alejcas]

Unable to fetch auth token. Error: (invalid_client) AADSTS700025: Client is public so neither 'client_assertion' nor 'client_secret' should be presented.

Hi, I've further studied this issue.

You have to set the redirect uri. It's not enough to check the checkbox for the redirect uri. You have to set the redirect uri text box with the desired redirect uri.

In the following image you can see that the textbox redirect uri is not set.

See #317

@rayeeskm can you check that?
@Narcolapser is this your case?

On the contrary if you have set a public client on purpose... well this library is not yet prepared to handle a device authentication flow.

[Narcolapser]

Yup. That seems to do it.