Access Microsoft Dataverse from Spring boot using Rest API - spring-boot

Question

I am currently in the process of connecting a Spring Boot application with Microsoft Dataverse.
The following requirements exist
CRUD operations in Dataverse tables
Users to log in to the Spring application using OAuth2 via the Microsoft account.
Attached is a sequence diagram to illustrate this
Sequence diagram
Unfortunately, I am failing with a 401 Unauthorized on the final access to a dataverse table.
I have done the following so far
entered the web application in Azure "App-Registration".
App Registration
generated client ID and client secret in Azure "App-Registration
Client Secrect & ID
set the API Rights to Dynamics CRM and Microsoft Graph in Azure "App-Registration".
API Access rights
Entered the app user in the Power Apps Admin area and gave access to the corresponding table via the role.
App User
Furthermore I have created the following code
dependencies in Maven
<dependency>
<groupId>com.azure.spring</groupId>
<artifactId>spring-cloud-azure-starter-active-directory</artifactId>
</dependency>
<dependency>
<groupId>com.azure.spring</groupId>
<artifactId>azure-spring-boot-starter-active-directory</artifactId>
<version>4.0.0</version>
</dependency>
<dependency>
<groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-reactive-httpclient</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-oauth2-client</artifactId>
</dependency>
<dependency>
application.yaml
spring.cloud.azure.active-directory:
enabled: true
profile.tenant-id: xxxx-xxxx-xxxx-xxxx-xxxx
credential:
client-id: xxxxxx-xxxx-xxxx-xxxx-xxxxx
client-secret: xxxxxxxxxxxxxxxxxxx
application-type: web-application
authorization-clients:
graph:
authorizationGrantType: client-credentials
scopes:
https://graph.microsoft.com/User.Read
dynamics:
authorizationGrantType: client-credentials
scopes:
https://xxxxxxx.crm4.dynamics.com/.default
rest service
import static org.springframework.security.oauth2.client.web.reactive.function.client.ServletOAuth2AuthorizedClientExchangeFilterFunction.oauth2AuthorizedClient;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.client.reactive.ReactorClientHttpConnector;
import org.springframework.security.oauth2.client.AuthorizedClientServiceOAuth2AuthorizedClientManager;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
import org.springframework.security.oauth2.client.annotation.RegisteredOAuth2AuthorizedClient;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.reactive.function.client.WebClient;
import org.springframework.web.reactive.function.client.WebClient.RequestHeadersUriSpec;
import org.springframework.web.reactive.function.client.WebClient.ResponseSpec;
import reactor.netty.http.client.HttpClient;
import reactor.netty.transport.logging.AdvancedByteBufFormat;
#RestController
public class DataverseRestController {
#Autowired
private WebClient webClient;
#Autowired
private OAuth2AuthorizedClientService manager;
#GetMapping("/graph")
#ResponseBody
public String produkte(#RegisteredOAuth2AuthorizedClient OAuth2AuthorizedClient client) {
if (null == client) {
return "Get response failed.";
}
RequestHeadersUriSpec<?> requestHeadersUriSpec = webClient.get();
ResponseSpec response = requestHeadersUriSpec
.uri("https://xxxxxxxx.crm4.dynamics.com/api/data/v9.2/cr2a0_xxxxxxxxx")
.attributes(oauth2AuthorizedClient(client)).retrieve();
String body = response.bodyToMono(String.class).block();
return "Get response " + (null != body ? "successfully" : "failed");
}
}
webclient config
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.client.reactive.ReactorClientHttpConnector;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
import org.springframework.security.oauth2.client.web.reactive.function.client.ServletOAuth2AuthorizedClientExchangeFilterFunction;
import org.springframework.web.reactive.function.client.WebClient;
import reactor.netty.http.client.HttpClient;
import reactor.netty.transport.logging.AdvancedByteBufFormat;
#Configuration
public class WebClientConfig {
#Bean
public WebClient webClient(OAuth2AuthorizedClientManager oAuth2AuthorizedClientManager) {
ServletOAuth2AuthorizedClientExchangeFilterFunction function = new ServletOAuth2AuthorizedClientExchangeFilterFunction(
oAuth2AuthorizedClientManager);
HttpClient httpClient = HttpClient.create().wiretap("reactor.netty.http.client.HttpClient",
io.netty.handler.logging.LogLevel.DEBUG, AdvancedByteBufFormat.TEXTUAL);
return WebClient.builder().clientConnector(new ReactorClientHttpConnector(httpClient)).apply(function.oauth2Configuration()).build();
}
}
I could make the following observations
it is strange, if I log in with my standard user, which has access to the table, I cannot call the table via the Rest API (401). If I log in normally as an admin, I can't either (401). However, if I go to the Power Platform Admin Center in the environment and call up the environment URL there via the link, I have to log in again even though I am already authenticated as an admin. Afterwards I can also call up the data of the table in Dataverse from the browser with the same URL. Link where I logged in an then the tables are shown
when calling the rest interface I can't specify the authorised client which is configured in the application.yaml. #RegisteredOAuth2AuthorizedClient and #RegisteredOAuth2AuthorizedClient("azure") work. #RegisteredOAuth2AuthorizedClient("dynamics") does not. Here comes null
the web application correctly forwards the unauthenticated user to Microsoft and the necessary data is also forwarded to the application as a token.
Can someone here possibly help and clarify what I am doing wrong?
My guess is that the Application.yaml file is not resolved correctly in the configuration and the scope for access to Dynamics is not sent in the OAuth2 handshake. This means that the user is not authorized for the Dynamics client. This would also explain that the authorized client is not present. However, I do not know what is wrong in the config

Answer 1

After a long research and trying, I have now come to the solution.
spring.cloud.azure.active-directory:
enabled: true
profile.tenant-id: xxxx-xxxx-xxxx-xxxx-xxxx
credential:
client-id: xxxxxx-xxxx-xxxx-xxxx-xxxxx
client-secret: xxxxxxxxxxxxxxxxxxx
application-type: web-application
authorization-clients:
**azure**:
authorizationGrantType: **authorization_code**
scopes:
https://xxxxxxx.crm4.dynamics.com/.default
is the right solution for the configuration