CODEWITHSUNDEEP
azureazure-ad-b2c
Raj Gupta
Raj Gupta

Reputation: 65

Change password using Graph API (Azure AD B2C)

From angular front-end and webapi as back-end, I'm trying to consume Graph API change password function, but I get following error:

{"odata.error":{"code":"Authorization_RequestDenied","message":{"lang":"en","value":"Access to change password operation is denied."}}}

Below is my code:

           private async void ChangePasswordPostRequest(ChangePasswordModel changePasswordModel){
                AuthenticationResult result = await authContext.AcquireTokenAsync(ApplicationConstants.aadGraphResourceId, credential);
                HttpClient http = new HttpClient();
                string url = ApplicationConstants.aadGraphEndpoint + tenant + "/users/" + "c55f7d4d-f81d-4338-bec7-145225366565" + "/changePassword?" + ApplicationConstants.aadGraphVersion;         

                HttpRequestMessage request = new HttpRequestMessage(new HttpMethod("POST"), url);
                request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", result.AccessToken);

                request.Content = new StringContent(JsonConvert.SerializeObject(new ChangePasswordPostModel() { currentPassword = changePasswordModel.CurrentPassword, newPassword = changePasswordModel.NewPassword }), Encoding.UTF8, "application/json");

                HttpResponseMessage response = await http.SendAsync(request);
                if (!response.IsSuccessStatusCode)
                {
                    string error = await response.Content.ReadAsStringAsync();
                    object formatted = JsonConvert.DeserializeObject(error);
                }
            }

I'm stuck at this, any help will be appreciated. Thanks in advance.

Upvotes: 0

Views: 1807

Answers (2)

FerronSW
FerronSW

Reputation: 535

The change password operation can only be called on behalf of the signed-in user. An application can change the password for a user using the reset password operation. The application must be assigned to the user account administrator role to change the password for the user. @Chris Padgett

With the beta endpoint of the Graph API it's now possible to get it done without PowerShell!

//Get App ObjectId
https://graph.microsoft.com/beta/servicePrincipals?$filter=appId eq '{appId}'

//Get roleId User Account Administrator role
GET: https://graph.microsoft.com/v1.0/directoryRoles?$filter=roleTemplateId eq 'fe930be7-5e62-47db-91af-98c3a49a38b1'

//If not found //Activate
POST: https://graph.microsoft.com/v1.0/directoryRoles

{
  "displayName": "User Account Administrator",
  "roleTemplateId": "fe930be7-5e62-47db-91af-98c3a49a38b1"
}

//Add member
POST: https://graph.microsoft.com/beta/directoryRoles/{Id}/members/$ref
{
  "@odata.id": "https://graph.microsoft.com/beta/servicePrincipals/{Id returned in first request}"
}

Upvotes: 1

Chris Padgett
Chris Padgett

Reputation: 14634

The change password operation can only be called on behalf of the signed-in user.

An application can change the password for a user using the reset password operation.

The application must be assigned to the user account administrator role to change the password for the user.

Upvotes: 0

Related Questions