[QUERY] - Get AAD Auth token from Azure Commercial to Azure Gov Cloud - is it possible?

[tapasudenia]

Query/Question
I am working on one project which is the integration of an app hosted in Azure commercial cloud with an app hosted in Azure Gov Cloud(.us). I need to get AAD auth token for an app-registration present in commercial cloud with the scope for an app registration created in Azure Gov Cloud.

Scenario

app registration id: app-reg-a-id
Tenant: some-commercial-tenant-a

app registration id: app-reg-b-id
Tenant: some-usgov-tenant-a

Referring to https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow

1. This is my postman request
   POST - https://login.microsoftonline.com/common/oauth2/v2.0/token
   grant_type - client_credentials
   client_id - app-reg-a-id
   client_secret - app-reg-a-secret-value
   scope- app-reg-b-id/.default

Error:
AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials

I tried setting tenant value too, get the same error.

2. Also I tried using The Azure Identity package - https://www.npmjs.com/package/@azure/identity
   Sample Code:

const newToken = async () => {
process.env.AZURE_CLIENT_SECRET = appSecret;
const scope = app-reg-b-id/.default;
const credential = new ClientSecretCredential(
'some-usgov-tenant-a',
'app-reg-a-id',
'app-reg-a-secret-value',
{
authorityHost: https://login.microsoftonline.us,
},
);
const {token: aadToken} = await credential.getToken(scope);
return aadToken;
};

Error: AADSTS700016 - Application with identifier 'app-reg-a-id' was not found in the directory 'some-usgov-tenant-a'

Also tried changing the authorityHost to https://login.microsoftonline.com

Error: AADSTS900382: Confidential Client is not supported in Cross Cloud request.

Question:

1. Is it possible to auth app registrations created in different clouds, commercial auth to us gov ?
2. If it is not possible, can someone please share some examples or reference for this as a workaround?
3. How to use the global - https://login.microsoftonline.com/common/oauth2/v2.0/token to get the token cross cloud? Please share examples if it is possible.
4. Can someone point out if I am doing anything wrong?

Please share any other thoughts.

[sadasant]

@tapasudenia Hello, Mr Udenia! I’m Daniel. I’ll be doing my best to help you!

First, I’ll answer your questions. Second, I’ll ask you some :)

Your questions:

Is it possible to auth app registrations created in different clouds, commercial auth to us gov?

Yes it is! We’re working on a sample for this scenario, but essentially, you can send the most appropriate authorityHost through the credentials’ constructor. We provide a set of common values through the AzureAuthorityHosts interface. So, for the US Government cloud, you could instantiate a credential this way:

const identity = require("@azure/identity");
const credential = new identity.ClientSecretCredential({
    authorityHost: identity.AzureAuthorityHosts.AzureGovernment
});

How to use the global - https://login.microsoftonline.com/common/oauth2/v2.0/token to get the token cross cloud? Please share examples if it is possible.

I believe you’ll need to use https://login.microsoftonline.us/ to access the Government cloud! Other common endpoints are: https://login.chinacloudapi.cn/ for China, or https://login.microsoftonline.de/ for Germany.

My questions:

Are you expecting to use app-reg-b-id in the scope?

Generally, I see scopes that represent the permissions given to the app registration on the API permissions section of your application in the portal. For example, one scope that is generally available is https://graph.microsoft.com/.default, as Microsoft Graph is enabled by default on most app registrations.

Are you able to reproduce the same problem with a scope like https://graph.microsoft.com/.default (or, for example, https://vault.azure.net/.default in case you’re working with a Key Vault).

What services are you expecting to reach with this credential? I can help you find an appropriate scope.

[ghost]

Hi, we're sending this friendly reminder because we haven't heard back from you in a while. We need more information about this issue to help address it. Please be sure to give us your input within the next 7 days. If we don't hear back from you within 14 days of this comment the issue will be automatically closed. Thank you!