The existing api assumes that the client application has permission to act without user delegation. In my application, the library is used behind an oauth2 proxy. The proxy does the oauth2 dance and passes back a header with the negotiated token. In this context, I need to use the token the proxy has negotiated and not have the client library refresh the token.
Steps to recreate:
- create app in azure
- setup permissions for calendar.read and user.read
- obtain tenant id, client id and client secret
- setup oauth2 proxy to use the settings in step 2.
- start up a backend that receives the token via X-Forwarded-Access-Token header.
Observed behavior:
Client can't "refresh" token because its permission scope is not user.read.all
The existing api assumes that the client application has permission to act without user delegation. In my application, the library is used behind an oauth2 proxy. The proxy does the oauth2 dance and passes back a header with the negotiated token. In this context, I need to use the token the proxy has negotiated and not have the client library refresh the token.
Steps to recreate:
Observed behavior:
Client can't "refresh" token because its permission scope is not user.read.all