I am making a lot of requests against azure ad / microsoft graph, and every now and then a /manager or /photo request returns 403 instead of a 404, but as far as I can tell we have the correct permissions in the jwt, and everything should be working OK?
I believe this could just be the behavior of the beta API, but I hope it is something I'm doing wrong so I can fix it :)
Here is the log I get back, the access token here is expired, but when I test immediately after the 403 comes back, the request responds instead with a 404. This is from a web application running node.js 5.x using request-promise to issue the requests.
{"name": "StatusCodeError","statusCode": 403,"message": "[Request Client] Error in get https://graph.microsoft.com/beta/myorganization/users/288033a1-78ff-40fb-92fe-18734d7c63a2/manager!","error": {"error": {"code": "Authorization_RequestDenied","message": "Insufficient privileges to complete the operation.","innerError": {"request-id": "acb87931-f1ba-4d8c-8c2b-6622737be836","date": "2016-06-15T22:55:20"
}
}
},"options": {"uri": "https://graph.microsoft.com/beta/myorganization/users/288033a1-78ff-40fb-92fe-18734d7c63a2/manager","method": "GET","headers": {"Authorization": "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Ik1uQ19WWmNBVGZNNXBPWWlKSE1iYTlnb0VLWSIsImtpZCI6Ik1uQ19WWmNBVGZNNXBPWWlKSE1iYTlnb0VLWSJ9.eyJhdWQiOiJodHRwczovL2dyYXBoLm1pY3Jvc29mdC5jb20vIiwiaXNzIjoiaHR0cHM6Ly9zdHMud2luZG93cy5uZXQvYmM2YjhkZDItZTc0Yy00OTZkLTg1MWQtMDIzOTMxZmIyZDIxLyIsImlhdCI6MTQ2NjAzMDk5NywibmJmIjoxNDY2MDMwOTk3LCJleHAiOjE0NjYwMzQ4OTcsImFjciI6IjEiLCJhbXIiOlsicHdkIl0sImFwcGlkIjoiNTg4NDlmYWUtNDVhNC00YmRjLWE4NmEtNDM5NjMzZjBiZTEzIiwiYXBwaWRhY3IiOiIxIiwiZmFtaWx5X25hbWUiOiJHZWxkb2YiLCJnaXZlbl9uYW1lIjoiQm9iIiwiaXBhZGRyIjoiOTguMjMyLjcuOTAiLCJuYW1lIjoiQm9iIEdlbGRvZiIsIm9pZCI6ImNkMTc3MWJjLTA4ODUtNDNjOS05OWZiLWI5ZTc1MTZlNTRlOSIsIm9ucHJlbV9zaWQiOiJTLTEtNS0yMS00NjU2MTM4LTQ0MTkwNTI4My0yNjAzODY4NzItMTEwNCIsInB1aWQiOiIxMDAzN0ZGRTk0N0YxNTc1Iiwic2NwIjoiQ29udGFjdHMuUmVhZFdyaXRlIE1haWwuUmVhZCBvZmZsaW5lX2FjY2VzcyBVc2VyLlJlYWQgVXNlci5SZWFkQmFzaWMuQWxsIFVzZXIuUmVhZFdyaXRlIiwic3ViIjoiaW83Y3EwdlFkRlBhR3pTdU1NVGdpbGk0OE96SWs4Qm1qcXZqSmptVWRjSSIsInRpZCI6ImJjNmI4ZGQyLWU3NGMtNDk2ZC04NTFkLTAyMzkzMWZiMmQyMSIsInVuaXF1ZV9uYW1lIjoiYm9iZ0BIeXBlckZpc2hEZXYwMS5vbm1pY3Jvc29mdC5jb20iLCJ1cG4iOiJib2JnQEh5cGVyRmlzaERldjAxLm9ubWljcm9zb2Z0LmNvbSIsInZlciI6IjEuMCJ9.gMnRxai4PQRR8Bo7QMLD6lvW65CGaJ-LmyRI_kA7XC2Toz5EecaTlCGUJYR-_XF9N5iYNo594OUGzCF7xTf1z58YR4EzxtfsfdzfD9RNPx_L9bTx8FGUC4L2Z-RSquTXQ9sywt2nycb0WdpsYARv01oZJrGGU4w4b9rYHqTZOmr6e_6g11OvhjXKgwg8UGnvq-_ee93Vt50ZX5NH0TFgho8CyxzH0DSyCckCgNrAYy1CSEJadd6kUE2I-PR8GbdX4-4v8eLq00UOAGXopC7uKxQQNI0UYr6ZRQEDBb9rjESKNnFJXrmmemW6M8gRfGKHVgcdXY-BZrfozmv5QvDPTA"
},"json": true,"simple": true,"resolveWithFullResponse": false
},"response": {"statusCode": 403,"body": {"$ref": "$[\"error\"]"
},"headers": {"cache-control": "private","transfer-encoding": "chunked","content-type": "application/json","server": "Microsoft-IIS/8.5","request-id": "acb87931-f1ba-4d8c-8c2b-6622737be836","client-request-id": "acb87931-f1ba-4d8c-8c2b-6622737be836","x-ms-ags-diagnostic": "{\"ServerInfo\":{\"DataCenter\":\"West US\",\"Slice\":\"SliceB\",\"ScaleUnit\":\"000\",\"Host\":\"AGSFE_IN_4\",\"ADSiteName\":\"WST\"}}","duration": "101.1805","x-powered-by": "ASP.NET","date": "Wed, 15 Jun 2016 22:55:19 GMT","connection": "close"
},"request": {"uri": {"protocol": "https:","slashes": true,"auth": null,"host": "graph.microsoft.com","port": 443,"hostname": "graph.microsoft.com","hash": null,"search": null,"query": null,"pathname": "/beta/myorganization/users/288033a1-78ff-40fb-92fe-18734d7c63a2/manager","path": "/beta/myorganization/users/288033a1-78ff-40fb-92fe-18734d7c63a2/manager","href": "https://graph.microsoft.com/beta/myorganization/users/288033a1-78ff-40fb-92fe-18734d7c63a2/manager"
},"method": "get","headers": {"Authorization": "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Ik1uQ19WWmNBVGZNNXBPWWlKSE1iYTlnb0VLWSIsImtpZCI6Ik1uQ19WWmNBVGZNNXBPWWlKSE1iYTlnb0VLWSJ9.eyJhdWQiOiJodHRwczovL2dyYXBoLm1pY3Jvc29mdC5jb20vIiwiaXNzIjoiaHR0cHM6Ly9zdHMud2luZG93cy5uZXQvYmM2YjhkZDItZTc0Yy00OTZkLTg1MWQtMDIzOTMxZmIyZDIxLyIsImlhdCI6MTQ2NjAzMDk5NywibmJmIjoxNDY2MDMwOTk3LCJleHAiOjE0NjYwMzQ4OTcsImFjciI6IjEiLCJhbXIiOlsicHdkIl0sImFwcGlkIjoiNTg4NDlmYWUtNDVhNC00YmRjLWE4NmEtNDM5NjMzZjBiZTEzIiwiYXBwaWRhY3IiOiIxIiwiZmFtaWx5X25hbWUiOiJHZWxkb2YiLCJnaXZlbl9uYW1lIjoiQm9iIiwiaXBhZGRyIjoiOTguMjMyLjcuOTAiLCJuYW1lIjoiQm9iIEdlbGRvZiIsIm9pZCI6ImNkMTc3MWJjLTA4ODUtNDNjOS05OWZiLWI5ZTc1MTZlNTRlOSIsIm9ucHJlbV9zaWQiOiJTLTEtNS0yMS00NjU2MTM4LTQ0MTkwNTI4My0yNjAzODY4NzItMTEwNCIsInB1aWQiOiIxMDAzN0ZGRTk0N0YxNTc1Iiwic2NwIjoiQ29udGFjdHMuUmVhZFdyaXRlIE1haWwuUmVhZCBvZmZsaW5lX2FjY2VzcyBVc2VyLlJlYWQgVXNlci5SZWFkQmFzaWMuQWxsIFVzZXIuUmVhZFdyaXRlIiwic3ViIjoiaW83Y3EwdlFkRlBhR3pTdU1NVGdpbGk0OE96SWs4Qm1qcXZqSmptVWRjSSIsInRpZCI6ImJjNmI4ZGQyLWU3NGMtNDk2ZC04NTFkLTAyMzkzMWZiMmQyMSIsInVuaXF1ZV9uYW1lIjoiYm9iZ0BIeXBlckZpc2hEZXYwMS5vbm1pY3Jvc29mdC5jb20iLCJ1cG4iOiJib2JnQEh5cGVyRmlzaERldjAxLm9ubWljcm9zb2Z0LmNvbSIsInZlciI6IjEuMCJ9.gMnRxai4PQRR8Bo7QMLD6lvW65CGaJ-LmyRI_kA7XC2Toz5EecaTlCGUJYR-_XF9N5iYNo594OUGzCF7xTf1z58YR4EzxtfsfdzfD9RNPx_L9bTx8FGUC4L2Z-RSquTXQ9sywt2nycb0WdpsYARv01oZJrGGU4w4b9rYHqTZOmr6e_6g11OvhjXKgwg8UGnvq-_ee93Vt50ZX5NH0TFgho8CyxzH0DSyCckCgNrAYy1CSEJadd6kUE2I-PR8GbdX4-4v8eLq00UOAGXopC7uKxQQNI0UYr6ZRQEDBb9rjESKNnFJXrmmemW6M8gRfGKHVgcdXY-BZrfozmv5QvDPTA","accept": "application/json","content-length": 0
}
}
},"level": "warn","timestamp": "2016-06-15T22:55:21.465Z"
}Any help would be appreciated, thanks!
