Call Dynamics CRM API from SPFx

Question

I want to call Dynamics CRM API from SPFx. What I've tried so far.

Code:

  this.context.aadHttpClientFactory
 .getClient('{ApplicationId}')
 .then((client: AadHttpClient): void => {
   client
     .get('<Organization URL>/api/data/v9.0/accounts?$select=name,address1_city&$top=10', AadHttpClient.configurations.v1)
     .then((response: HttpClientResponse): any => {
       console.log(response);
       return response.json();
     });
 });

After that, an alert appears which shows the message:

Additional credentials are required to show this page correctly.

If I click Ok then it will redirect to SharePoint home page. Else if I click Cancel then it will show me the error:

Error: AADSTS65001: The user or administrator has not consented to use the application with ID '' named 'SharePoint Online Client Extensibility Web Application Principal'. Send an interactive authorization request for this user and resource.

Tried Solution:

Already Grant Permission in Azure AD app. Permission is set for Dynamics CRM online.

Image Description:

EDIT

Sometimes it shows the error mentioned in the image.

Image Description:

Answer 1

It seems you have an issue similar to this one: https://github.com/SharePoint/sp-dev-docs/issues/2473#issuecomment-419267563

The workaround for now is to add the User.Read scope for AAD in the package-solution.json

"webApiPermissionRequests": [
      {
        "resource": "Windows Azure Active Directory",
        "scope": "User.Read"
      }
    ]

And then re-upload your solution and re-approve the permissions in the SPO Tenant Admin API management page.

But as I understand, a fix is being rolled out to all Azure AD tenants which would mean we no longer have to do the workaround.

Answer 2

Go to the Azure AD and grant CRM Dynamics permissions to the "SharePoint Online Client Extensibility Web Application Principal". Find this under App Registrations in your Azure AD.

https://github.com/SharePoint/sp-dev-docs/issues/2601

Then get the client by:

this.context.aadHttpClientFactory
    .getClient('https://[company].crm4.dynamics.com')
    .then((client: AadHttpClient): void => {

Answer 3

Try this:

1.) Go to Azure App Registration, Open your registration manifest, and change this line from false, to true: "oauth2AllowImplicitFlow": false

2.) Then go to the registration settings, and in the Required permissions click the 'Grant permission' button, then yes. This will overrule the consent(or its absence) of all users in the directory. This way users do not need to consent one-by-one phisically clicking a button to log in with their account trough oauth.

You can check these granted permission in the app's page in the permissions section.