Sharepoint 365 ACS OAuth in Objective-C: error in scope - help needed

Question

Okay, so we are building an iPhone app to get to Sharepoint 2013 hosted in Office 365. If I built it in C #, which I already did, it would be easy for me to just use TokenHelper. cs to get most of the way from me. Unfortunately, to my knowledge, TokenHelper does not yet exist for Objective-C.

So, here's the deal, we can already successfully get the OAuth authentication / authorization page, and we will get the authorization code again.

After that, we stumbled a bit, because we knew that we did not have the identifier of the region in POST to get Access and Refresh tokens. Finally, I realized how TokenHelper does it, and we duplicated it. (This was an extra call to /_vti_bin/client.svc, where you expect to get 401 so you can get the id of the area from the header)

Now we have an area identifier, which, from what I read in the documentation and TokenHelper and saw in Fiddler, should then be used in the following two ways: in the URL structure for POST, and also for the resource, the value in the header for this POST.

So the POST URL looks like this:

accounts.accesscontrol.windows.net/{realm id} / tokens / oauth / 2

The value of our resource is as follows:

resource = 00000003-0000-0ff1-ce00-000000000000% 2f {realm url}% 40 {realm id}

It at least connects perfectly and accepts our POST. Unfortunately, we get the following message:

ACS50012: Authentication failed. ACS90011: Realm '' is not a configured scope of the current service namespace.

This message makes me think that there might be a configuration problem, but I really cannot be sure.

Has anyone else tried to run OAuth against a 365 site back in Objective-C and succeeded?

I can also send the code, but at first I tried to avoid it.

Answer 1

I recently ran into the same problem and feel that this may be the same problem you are seeing.

The correct POST request for OAuth is as follows:

POST https://accounts.accesscontrol.windows.net/<REALM_GUID>/tokens/OAuth/2 x-www-form-urlencoded params: grant_type:authorization_code client_id:<CLIENT_ID>@<REALM_GUID> client_secret:<CLIENT_SECRET> code:<AUTH_CODE> redirect_uri:<REDIRECT_URI> resource:00000003-0000-0ff1-ce00-000000000000/<SHAREPOINT_AUTHORITY>@<REALM_GUID> 

The main way for me was that the value of "client_id" required that the area identifier be added to the client identifier. Apart from the area identifier, you selected "ACS90011: The realm" - this is not the configured space of the current service namespace.

NTN