cancel
Showing results for 
Search instead for 
Did you mean: 
Reply
Phil0001
Regular Visitor

AADSTS50001 - Specify resource_id in www-authenticate response header?

We are connecting to an API to get data.

 

Authentication is via AAD and this is working successfully since we added the www-authenticate response header identifying the authorization url:

e.g.

WWW-Authenticate: Bearer authorization_uri=https://login.microsoftonline.com/xyz/oauth2/authorize

 

However, we then get the AADSTS50001 error "The application named X was not found in the tenant named Y". In fact the resource we are targetting *does* exist, it is just named differently. (The AAD application name does not match the API endpoint domain name as seems to be expected\assumed).

 

If we create an AAD application with the assumed name (https://api.xxx.co.nz) we can get it to work and return data, but that's just a cumbersome workaround.

 

Can we specify the resource_id in the www-authenticate response header along with the authorization_uri, something like this:

 

Bearer authorization_uri=https://login.microsoftonline.com/xyz/oauth2/authorize, resource_id=https://xxx.dev.yyy.co.nz

 

 

6 REPLIES 6
Anonymous
Not applicable

Hi, All,

 

I have similar problem. Is there any solution to it?

 

Thanks.

mcus
New Member

Hey, 
I have the same problem, somebody resolve this problem?

 

Cheers,

M

Eric_Zhang
Microsoft
Microsoft


@Phil0001 wrote:

We are connecting to an API to get data.

 

Authentication is via AAD and this is working successfully since we added the www-authenticate response header identifying the authorization url:

e.g.

WWW-Authenticate: Bearer authorization_uri=https://login.microsoftonline.com/xyz/oauth2/authorize

 

However, we then get the AADSTS50001 error "The application named X was not found in the tenant named Y". In fact the resource we are targetting *does* exist, it is just named differently. (The AAD application name does not match the API endpoint domain name as seems to be expected\assumed).

 

If we create an AAD application with the assumed name (https://api.xxx.co.nz) we can get it to work and return data, but that's just a cumbersome workaround.

 

Can we specify the resource_id in the www-authenticate response header along with the authorization_uri, something like this:

 

Bearer authorization_uri=https://login.microsoftonline.com/xyz/oauth2/authorize, resource_id=https://xxx.dev.yyy.co.nz

 

 


@Phil0001

What API is connected to get data? You description is confusing as it seems to have nothing to do with Power BI. Since your question is more related to Azure AD, for better response, I'd suggest you post in the dedicated Azure AD forum.

@Eric_Zhang

Hi,
It is related to Power BI Desktop accessing an OAuth protected API but seemingly providing no way for us to specify the OAuth resource.

 

We can get authentication working by sending the authorization_url in the www-authenticate response header, but we cannot specify the OAuth resource to target so accessing the API ultimately fails after authentication.

 

We have no trouble with AAD generally but when accessing our API's through Power BI Desktop we have a lot of trouble, hence my question is here!

 

So,
I have captured in Fiddler the request sent by pbidesktop.exe to login.microsoftonline.com. As you can see the 'resource' is hardcoded as the API we are accessing. (I've separated parameters for clarity). This 'resource' is not correct and is what is causing the issue.

To reiterate, this is POWER BI crafting this HTTP request and sending it to the specified authorization_url but also adding a few parameters of it's own, some of which we really need to specify somehow - 'resource':
 
GET https://login.microsoftonline.com/dev2.onmicrosoft.com/oauth2/authorize
?state=9d21fd
&display=popup
&client_id=a672
&redirect_uri=https://de-users-preview.sqlazurelabs.com
&resource=https://myapi.dev.domain.co.nz <----WRONG, BUT WE CANNOT CHANGE?
&response_type=code
&prompt=select_account
&scope=user_impersonation
&mkt=en-US

 

How do we specify to Power BI the actual OAuth 'resource' we are targetting - either through the UI for accessing web data, or in the www-authenticate response header we send from our API?

 

e.g.

www-authenticate: Bearer authorization_uri=https://login.microsoftonline.com/xyz/oauth2/authorize, resource_id=https://xxx.dev.yyy.co.nz

 

 

 

@Eric_Zhang

got any ideas?

 

Ta

 

@Phil0001 Were you ever able to get this working?
@Eric_Zhang I have the same problem. We could really use some help here! Thanks!

Helpful resources

Announcements
PBI_User Group Leader_768x460.jpg

Manage your user group events

Check out the News & Announcements to learn more.

Welcome Super Users.jpg

Super User Season 2

Congratulations, the new Super User Season 2 for 2021 has started!

Community Connections 768x460.jpg

Community & How To Videos

Check out the new Power Platform Community Connections gallery!

Teds Dev Camp Oct. 2021 768x460.jpg

Power BI Dev Camp - October 28th, 2021

Mark your calendars and join us for our next Power BI Dev Camp!