I'm trying to configure OAuth authentication between Exchange and Exchange Online using article:
https://docs.microsoft.com/en-us/exchange/configure-oauth-authentication-between-exchange-and-exchange-online-organizations-exchange-2013-help
After completing all steps, when I try to test on-prem using following command:
Test-OAuthConnectivity -Service EWS -TargetUri https://outlook.office365.com/ews/exchange.asmx -Mailbox msmith@contoso.com -Verbose | Format-List
then it give error that it cannot find certificate. However, I have verified and same thumbprint exists Exchange on-prem and Online. The thumbprint was matched using following commands:
On-prem:
Get-ExchangeCertificate -Thumbprint (Get-AuthConfig).CurrentCertificateThumbprint | fl
Online:
Get-MsolServicePrincipalCredential -ServicePrincipalName "00000002-0000-0ff1-ce00-000000000000" -ReturnKeyValues $true
While testing OAuthConnectivity, below is the complete error details I'm getting. Would anyone know a solution for this issue?
#TYPE Microsoft.Exchange.Security.OAuth.ValidationResultNode
"PSComputerName","RunspaceId","PSShowComputerName","Task","Detail","ResultType","Identity","IsValid","ObjectState"
"dom2-exh01.testdomain2.local","15d06d5e-3ca1-43a8-be42-4d397275cb26","False","Checking EWS API Call Under Oauth","The configuration was last successfully loaded at 7/24/2020 6:37:58 PM UTC. This was 1 minutes ago.
The token cache is being cleared because ""use cached token"" was set to false.
Exchange Outbound Oauth Log:
Client request ID: 3644586e-1c85-4ab2-927a-167f38ce1209
Information:[OAuthCredentials:Authenticate] entering
Information:[OAuthCredentials:Authenticate] challenge from 'https://outlook.office365.com/ews/Exchange.asmx' received: Bearer client_id=""00000002-0000-0ff1-ce00-000000000000"", trusted_issuers=""00000001-0000-0000-c000-000000000000@*"", token_types=""app_asserted_user_v1 service_asserted_app_v1"", authorization_uri=""https://login.windows.net/common/oauth2/authorize"",Basic Realm=""""
Information:[OAuthCredentials:GetToken] client-id: '00000002-0000-0ff1-ce00-000000000000', realm: '', trusted_issuer: '00000001-0000-0000-c000-000000000000@*'
Information:[OAuthCredentials:GetToken] Start building a token using organizationId ''
Information:[OAuthTokenBuilder:GetAppToken] start building the apptoken
Information:[OAuthTokenBuilder:GetAppToken] checking enabled auth servers
Information:[OAuthTokenBuilder:GetAppToken] trusted_issuer includes the auth server 'WindowsAzureACS': 00000001-0000-0000-c000-000000000000@ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ,
Information:[OAuthTokenBuilder:GetAppToken] updating the tenant id with the auth server realm; current tenant id value is '', new value is 'ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ'
Information:[OAuthTokenBuilder:GetAppToken] trying to get the apptoken from the auth server 'WindowsAzureACS' for resource '00000002-0000-0ff1-ce00-000000000000/outlook.office365.com@ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ', tenantId 'ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ', userDomain 'contoso.com'
Information:[TokenCache:GetActorToken] Each key and its counts are L:00000002-0000-0ff1-ce00-000000000000-AS:00000001-0000-0000-c000-000000000000@ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ, 0
Information:[TokenCache:GetActorToken] cache size is 0
Information:[TokenCache:GetActorToken] try to get a new token synchronously
Information:[ACSTokenBuildRequest:BuildToken] started
Information:[TokenBuildRequest:GetActorTokenFromAuthServer] Sending token request to 'https://accounts.accesscontrol.windows.net/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ/tokens/OAuth/2' for the resource '00000002-0000-0ff1-ce00-000000000000/outlook.office365.com@ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ' with token: grant_type=http%3a%2f%2foauth.net%2fgrant_type%2fjwt%2f1.0%2fbearer&assertion=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Im9QZjdDRnNra2MwTkEzeW14QUlITGhVckR4RSJ9.eyJpc3MiOiIwMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDBANmJhYmNhYWQtNjA0Yi00MGFjLWE5ZDctOWZkOTdjMGI3NzlmIiwiYXVkIjoiMDAwMDAwMDEtMDAwMC0wMDAwLWMwMDAtMDAwMDAwMDAwMDAwL2FjY291bnRzLmFjY2Vzc2NvbnRyb2wud2luZG93cy5uZXRANmJhYmNhYWQtNjA0Yi00MGFjLWE5ZDctOWZkOTdjMGI3NzlmIiwiZXhwIjoxNTk1NjE2NTQ5LCJuYmYiOjE1OTU2MTU5NDl9.XsjAMihN7uatNX5qNSaqVK2F74_nD0ZGZJq8wPopnoROVTylfQj5Yr9-_m0H3SLnL2EHmTp0NIzOTQD6KOPnQYO9yxev_lXVunssNBJUjqYBtfFsOdZ5-g3DXkRzSK0Aytx00hE4vPiyTZjjwj4CW-KYYKNzIKQgo0sKiM6H42uBJnIDSKh5UmY_Rl3RAGz_3V-fQ0vqnpalf_xKwNnNZalRnyuLqYSWJJjg8UjulB-GewSCExU28CydrSpXYr_SupYpH0BXbOFV5lD0iXWyxPhaWJ0TrUptgDBlYibjRaYUh9SNMD_5d88Crz57Lekr7tf3wR2d-IbR4Zg-hfunxg&resource=00000002-0000-0ff1-ce00-000000000000%2foutlook.office365.com%40ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ
Information:[TokenBuildRequest:GetErrorDescription] response headers was
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
client-request-id: 3644586e-1c85-4ab2-927a-167f38ce1209
x-ms-request-id: 7c9c2ff1-7325-4ac0-9920-debbbb3d0600
x-ms-ests-server: 2.1.10877.10 - CHI ProdSlices
Cache-Control: no-cache, no-store
Content-Type: application/json; charset=utf-8
Expires: -1
P3P: CP=""DSP CUR OTPi IND OTRi ONL FIN""
Set-Cookie: ----
Date: Fri, 24 Jul 2020 18:39:09 GMT
Content-Length: 602
Error:[TokenBuildRequest:GetActorTokenFromAuthServer] Unable to get the token from auth server 'https://accounts.accesscontrol.windows.net/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ/tokens/OAuth/2'. The request has token grant_type=http%3a%2f%2foauth.net%2fgrant_type%2fjwt%2f1.0%2fbearer&assertion=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Im9QZjdDRnNra2MwTkEzeW14QUlITGhVckR4RSJ9.eyJpc3MiOiIwMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDBANmJhYmNhYWQtNjA0Yi00MGFjLWE5ZDctOWZkOTdjMGI3NzlmIiwiYXVkIjoiMDAwMDAwMDEtMDAwMC0wMDAwLWMwMDAtMDAwMDAwMDAwMDAwL2FjY291bnRzLmFjY2Vzc2NvbnRyb2wud2luZG93cy5uZXRANmJhYmNhYWQtNjA0Yi00MGFjLWE5ZDctOWZkOTdjMGI3NzlmIiwiZXhwIjoxNTk1NjE2NTQ5LCJuYmYiOjE1OTU2MTU5NDl9.XsjAMihN7uatNX5qNSaqVK2F74_nD0ZGZJq8wPopnoROVTylfQj5Yr9-_m0H3SLnL2EHmTp0NIzOTQD6KOPnQYO9yxev_lXVunssNBJUjqYBtfFsOdZ5-g3DXkRzSK0Aytx00hE4vPiyTZjjwj4CW-KYYKNzIKQgo0sKiM6H42uBJnIDSKh5UmY_Rl3RAGz_3V-fQ0vqnpalf_xKwNnNZalRnyuLqYSWJJjg8UjulB-GewSCExU28CydrSpXYr_SupYpH0BXbOFV5lD0iXWyxPhaWJ0TrUptgDBlYibjRaYUh9SNMD_5d88Crz57Lekr7tf3wR2d-IbR4Zg-hfunxg&resource=00000002-0000-0ff1-ce00-000000000000%2foutlook.office365.com%40ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ, the error from Sts is AADSTS700027: Client assertion contains an invalid signature. [Reason - The key was not found., Thumbprint of key used by client: '****************************************']
Trace ID: 7c9c2ff1-7325-4ac0-9920-debbbb3d0600
Correlation ID: 3644586e-1c85-4ab2-927a-167f38ce1209
Timestamp: 2020-07-24 18:39:09Z, the exception is System.Net.WebException: The remote server returned an error: (401) Unauthorized.
at System.Net.HttpWebRequest.GetResponse()
at Microsoft.Exchange.Security.OAuth.TokenBuildRequest.GetActorTokenFromAuthServer(Boolean throwOnError, TokenLifeTime tokenLifeTimeInstance, OAuth2AccessTokenRequest oauth2Request, String stsEndpoint)
Error:Unable to get token from Auth Server. Error code: 'invalid_client'. Description: 'AADSTS700027: Client assertion contains an invalid signature. [Reason - The key was not found., Thumbprint of key used by client: '****************************************']
Trace ID: 7c9c2ff1-7325-4ac0-9920-debbbb3d0600
Correlation ID: 3644586e-1c85-4ab2-927a-167f38ce1209
Timestamp: 2020-07-24 18:39:09Z'.
Exchange Response Details:
HTTP response message:
Exception:
System.Net.WebException: The request was aborted: The request was canceled. ---> Microsoft.Exchange.Security.OAuth.OAuthTokenRequestFailedException: Unable to get token from Auth Server. Error code: 'invalid_client'. Description: 'AADSTS700027: Client assertion contains an invalid signature. [Reason - The key was not found., Thumbprint of key used by client: '****************************************']
Timestamp: 2020-07-24 18:39:09Z'. ---> System.Net.WebException: The remote server returned an error: (401) Unauthorized.
at System.Net.HttpWebRequest.GetResponse()
at Microsoft.Exchange.Security.OAuth.TokenBuildRequest.GetActorTokenFromAuthServer(Boolean throwOnError, TokenLifeTime tokenLifeTimeInstance, OAuth2AccessTokenRequest oauth2Request, String stsEndpoint)
--- End of inner exception stack trace ---
at Microsoft.Exchange.Security.OAuth.TokenBuildRequest.GetActorTokenFromAuthServer(Boolean throwOnError, TokenLifeTime tokenLifeTimeInstance, OAuth2AccessTokenRequest oauth2Request, String stsEndpoint)
at Microsoft.Exchange.Security.OAuth.ACSTokenBuildRequest.BuildToken(Boolean throwOnError)
at Microsoft.Exchange.Security.OAuth.TokenCache.GetActorToken(TokenBuildRequest tokenBuildRequest, TokenLifeTime tokenLifeTime, IOutboundTracer tracer, Nullable`1 clientRequestId)
at Microsoft.Exchange.Security.OAuth.OAuthTokenBuilder.GetAppToken(String applicationId, String destinationHost, String realmFromChallenge, IssuerMetadata[] trustedIssuersFromChallenge, String userDomain)
at Microsoft.Exchange.Security.OAuth.OAuthTokenBuilder.GetAppWithUserToken(String applicationId, String destinationHost, String realmFromChallenge, IssuerMetadata[] trustedIssuersFromChallenge, String userDomain, ClaimProvider claimProvider)
at Microsoft.Exchange.Security.OAuth.OAuthCredentials.GetToken(WebRequest webRequest, HttpAuthenticationChallenge challengeObject)
at Microsoft.Exchange.Security.OAuth.OAuthCredentials.Authenticate(String challengeString, WebRequest webRequest, Boolean preAuthenticate)
at System.Net.AuthenticationManagerDefault.Authenticate(String challenge, WebRequest request, ICredentials credentials)
at System.Net.AuthenticationState.AttemptAuthenticate(HttpWebRequest httpWebRequest, ICredentials authInfo)
at System.Net.HttpWebRequest.CheckResubmitForAuth()
at System.Net.HttpWebRequest.CheckResubmit(Exception& e, Boolean& disableUpload)
at System.Net.HttpWebRequest.DoSubmitRequestProcessing(Exception& exception)
at System.Net.HttpWebRequest.ProcessResponse()
at System.Net.HttpWebRequest.SetResponse(CoreResponseData coreResponseData)
--- End of inner exception stack trace ---
at System.Net.HttpWebRequest.GetResponse()
at Microsoft.Exchange.Monitoring.TestOAuthConnectivityHelper.SendExchangeOAuthRequest(ADUser user, String orgDomain, Uri targetUri, String& diagnosticMessage, Boolean appOnly, Boolean useCachedToken, Boolean reloadConfig)
","Error","Microsoft.Exchange.Security.OAuth.ValidationResultNodeId","True","New"
