Add correct audience to token for non Azure public clouds

src/main/java/com/microsoft/jenkins/azuread/AzureSecurityRealm.java

@@ -140,7 +140,8 @@
         ClientSecretCredential clientSecretCredential = getClientSecretCredential();
 
         TokenRequestContext tokenRequestContext = new TokenRequestContext();
-        tokenRequestContext.setScopes(singletonList("https://graph.microsoft.com/.default"));
+        String graphResource = AzureEnvironment.getGraphResource(getAzureEnvironmentName());
+        tokenRequestContext.setScopes(singletonList(graphResource + ".default"));
 
         AccessToken accessToken = clientSecretCredential.getToken(tokenRequestContext).block();
 

src/main/java/com/microsoft/jenkins/azuread/GraphClientCache.java

@@ -10,6 +10,7 @@
 import hudson.ProxyConfiguration;
 import hudson.util.Secret;
 import io.jenkins.plugins.azuresdk.HttpClientRetriever;
+import java.net.URI;
 import jenkins.model.Jenkins;
 import jenkins.util.JenkinsJVM;
 import okhttp3.Credentials;
@@ -21,6 +22,7 @@
 
 import static com.microsoft.jenkins.azuread.AzureEnvironment.AZURE_PUBLIC_CLOUD;
 import static com.microsoft.jenkins.azuread.AzureEnvironment.getAuthorityHost;
+import static com.microsoft.jenkins.azuread.AzureEnvironment.getGraphResource;
 import static com.microsoft.jenkins.azuread.AzureEnvironment.getServiceRoot;
 
 public class GraphClientCache {
@@ -38,52 +40,54 @@
         OkHttpClient.Builder builder = HttpClients.createDefault(authProvider)
                 .newBuilder();
 
-        builder = addProxyToHttpClientIfRequired(builder);
+        builder = addProxyToHttpClientIfRequired(builder, key.getAzureEnvironmentName());
         final OkHttpClient graphHttpClient = builder.build();
 
         GraphServiceClient<Request> graphServiceClient = GraphServiceClient
                 .builder()
                 .httpClient(graphHttpClient)
                 .buildClient();
 
         String azureEnv = key.getAzureEnvironmentName();
 
         if (!azureEnv.equals(AZURE_PUBLIC_CLOUD)) {
             graphServiceClient.setServiceRoot(getServiceRoot(azureEnv));
         }
         return graphServiceClient;
     }
 
     static ClientSecretCredential getClientSecretCredential(GraphClientCacheKey key) {
         return new ClientSecretCredentialBuilder()
                 .clientId(key.getClientId())
                 .clientSecret(key.getClientSecret())
                 .tenantId(key.getTenantId())
                 .authorityHost(getAuthorityHost(key.getAzureEnvironmentName()))
                 .httpClient(HttpClientRetriever.get())
                 .build();
     }
 
     static GraphServiceClient<Request> getClient(GraphClientCacheKey key) {
         return TOKEN_CACHE.get(key);
     }
 
     public static GraphServiceClient<Request> getClient(AzureSecurityRealm azureSecurityRealm) {
         GraphClientCacheKey key = new GraphClientCacheKey(
                 azureSecurityRealm.getClientId(),
                 Secret.toString(azureSecurityRealm.getClientSecret()),
                 azureSecurityRealm.getTenant(),
                 azureSecurityRealm.getAzureEnvironmentName()
         );
 
         return TOKEN_CACHE.get(key);
     }
 
-    public static OkHttpClient.Builder addProxyToHttpClientIfRequired(OkHttpClient.Builder builder) {
+    public static OkHttpClient.Builder addProxyToHttpClientIfRequired(OkHttpClient.Builder builder, String azureEnvironmentName) {
         if (JenkinsJVM.isJenkinsJVM()) {
             ProxyConfiguration proxyConfiguration = Jenkins.get().getProxy();
             if (proxyConfiguration != null && StringUtils.isNotBlank(proxyConfiguration.getName())) {
-                Proxy proxy = proxyConfiguration.createProxy("graph.microsoft.com");
+
+                String graphHost = URI.create(getGraphResource(azureEnvironmentName)).getHost();
+                Proxy proxy = proxyConfiguration.createProxy(graphHost);
 
                 builder = builder.proxy(proxy);
                 if (StringUtils.isNotBlank(proxyConfiguration.getUserName())) {

src/main/java/com/microsoft/jenkins/azuread/GraphProxy.java

@@ -165,7 +165,12 @@
     private OkHttpClient getClient() {
         ProxyConfiguration proxyConfiguration = Jenkins.get().getProxy();
         if (proxyConfiguration != null && StringUtils.isNotBlank(proxyConfiguration.getName())) {
-            return addProxyToHttpClientIfRequired(new OkHttpClient().newBuilder()).build();
+            SecurityRealm securityRealm = Jenkins.get().getSecurityRealm();
+            AzureSecurityRealm azureSecurityRealm = ((AzureSecurityRealm) securityRealm);
+
+            String azureEnvironmentName = azureSecurityRealm.getAzureEnvironmentName();
+
+            return addProxyToHttpClientIfRequired(new OkHttpClient().newBuilder(), azureEnvironmentName).build();
         }
         return DEFAULT_CLIENT;
     }