My end goal is getting an access token with which I can communicate to a SharePoint site and manage lists via CSOM (mostly upload documents into lists). I also need a refresh token to manage refreshing the tokens silently in the background.
There seems to be 2 ways of obtaining the credentials required for OAuth 2.0 with SharePoint Online. Via the: appregnew.aspx, and the appinv.aspx.
The "appregnew.aspx" gives you a ClientID and ClientSecret and seems to be independent from Azure AD.
The "appinv.aspx" seems to be dependant on Azure AD. You need to specify a ClientID which refers to an App registration that needs to have already been registered in the Azure AD.
I had been using a library which I had found online. This seems to include an implementation which is similar to what is explained here. This is still working in my localhost. However, when deployed to an Azure Web App I am getting the below error / partial stack trace:
"Token request failed" at Microsoft.IdentityModel.S2S.Protocols.OAuth2.OAuth2S2SClient.Issue(String securityTokenServiceUrl, OAuth2AccessTokenRequest oauth2Request) at SP.SiteCreatorWeb.TokenHelper.GetAccessToken(String authorizationCode, String targetPrincipalName, String targetHost, String targetRealm, String redirectUri, String inClientID, String inClientSecret) in C:\AppsGit\SharePointPowerHour\SP.SiteCreatorWeb\TokenHelper.cs:line 215
I searched the web about this error and some people suggested upgrading the .Net Framework, which I've upgraded to 4.8, and forcing TLS 1.2, which I also did. The issue still persisted.
I was also wondering about the "appinv.aspx" / app registration way. At some point I had managed to get this to work via the same library - I would create the app registration, possibly specify the SharePoint related API permissions, grant admin consent, then use the client ID to register the app registration within the "appinv.aspx" page. Then using the library linked above, I would be able to get an access token and use it with CSOM.
Today, I tried that same approach and I got a "Token request failed" error in the same method: Microsoft.IdentityModel.S2S.Protocols.OAuth2.OAuth2S2SClient.Issue.
I am also aware of the Authorization Code grant flow against Azure AD directly. Is the Azure AD token you retrieve from this process somehow usable with SharePoint? In the Azure AD App Registrations you can specify SharePoint related API permissions but not sure the OAuth process with Azure AD would be enough.
Any other ideas about the aforementioned issues would be appreciated. Also, it would be great if someone could direct me towards the "low-level" endpoints and payload examples that need to be called, to generate a SharePoint Online access token, and refresh the access token with a refresh token. It would be useful to find the same level of detail that one can find in the Azure AD article for the SharePoint Online OAuth 2.0 case. I prefer communicating directly with the endpoints, rather than using a library that obfuscates that part of the implementation. This is something I managed to find in all other cases of OAuth 2.0 that I ever had to work with, apart from SharePoint Online.