Nrthugu

I am building a daemon/non-interactive service to use EWS in O365 as a specific user. In order to communicate with EWS over OAUTH2.0 I am trying to properly register the application and authenticate against AAD. Preferably I would like to use certificate based authentication, but I did not get that far.

The code is below (its working):

    static void Main(string args)

    {

        string tenant = "redacted.onmicrosoft.com";

        string authority = "https://login.microsoftonline.com/" + tenant;

        string clientId = "44964df2-3333-2222-1111-redcated";

        string resource = "https://outlook.office365.com";

        string clientSecret = "redacted";

        string username = "username@redacted.onmicrosoft.com";

        string password = "redacted";



        AuthenticationResult authenticationResult = null;

        AuthenticationContext authenticationContext = new AuthenticationContext(authority, false);



        var userCred = new UserPasswordCredential(username, password);

        ClientCredential clientCred = new ClientCredential(clientId, clientSecret);



        string errorMessage = null;

        try

        {

            Console.WriteLine("Trying to acquire token");

            authenticationResult = authenticationContext.AcquireTokenAsync(resource, clientId, userCred).Result;

        }

        catch (AdalException ex)

        {

            errorMessage = ex.Message;

            if (ex.InnerException != null)

            {

                errorMessage += "nInnerException : " + ex.InnerException.Message;

            }

        }

        catch (ArgumentException ex)

        {

            errorMessage = ex.Message;

        }

        if (!string.IsNullOrEmpty(errorMessage))

        {

            Console.WriteLine("Failed: {0}" + errorMessage);

            return;

        }

        Console.WriteLine("nMaking the protocol calln");

        ExchangeService service = new ExchangeService(ExchangeVersion.Exchange2013_SP1);

        service.Credentials = new OAuthCredentials(authenticationResult.AccessToken);

        service.TraceEnabled = true;

        service.TraceFlags = TraceFlags.All;

        service.Url = new Uri(resource + "/EWS/Exchange.asmx");

        EmailMessage email = new EmailMessage(service);

        email.ToRecipients.Add("redacted@gmail.com");

        email.Subject = "HelloWorld from EWS";

        email.Body = new MessageBody("Test from EWS");

        email.Send();

    }

This code works as intended, however, I also need to ensure that it is secure/according to best practice.

When using the code, I registered the application as "Native", however, I have later found that Micrsofts manual says you should not use client_secret with Native applications, and the client secret is not actually used by the code either in its current form.

Considering the use case (non-interactive service authenticate as one specific user), is this the correct approach?

What should I consider when registering the service in AAD?

I have later found that Micrsofts manual says you should not use
client_secret with Native applications

Client_secret cannot be used in a native app (public client), because client_secrets cannot be reliably stored on devices. It is required for web apps and web APIs (all confidential clients), which have the ability to store the client_secret securely on the server side.

Considering the use case (non-interactive service authenticate as one
specific user), is this the correct approach?

Yes, the OAuth 2.0 Client Credentials Grant Flow permits a web service (confidential client) to use its own credentials instead of impersonating a user, to authenticate when calling another web service. While Oauth 2.0 auth code grant flow and OpenId Connect is impersonating a user that needs the user sign in.

What should I consider when registering the service in AAD?

You could read this doc, it will introduce the main structure about the AAD service.