Get Http request "received HTTP status response: 401"

[Steven Vits]

I'm trying to set up a http request in an automation rule.

1. post action to 'https://login.microsoftonline.com/<TenentID>/oauth2/v2.0/token'
2. creating var: Bearer {{webhookResponse.body.access_token}} seems succesfull
3. get action to API with header 'Authorization' with var as a value is returning a 401 response

"Unable to publish the web request - received HTTP status response:

401

Error found in the HTTP body response:

{"error":{"code":"SecurityTokenInvalidSignature","message":"The provided authentication token is not valid, token signature is not properly formatted."}}"

This setup is working fine in postman but is refusing to work in JSM automation. 

Any ideas in what I am overseeing?

[Steven Vits · Accepted solution]

found the issue:

in the post action to get the acces token the 'scope' was not correct. it stated graph.microsoft.com  instead of service.flow.microsoft.com 

thank you all for the needed help and overthinking.

[Charlie Misonne · Accepted solution]

Hi Steven,

Are you sure about the "webhookResponse" smart value? I know it exists for Jira Data Center but on Jira Cloud I always use "webResponse".

Here is what I have for the Authorization header.

Bearer {{webResponse.body.access_token}}

+ make sure you check this option on the call where you are requesting the token "Delay execution of subsequent rule actions until we've received a response for this web request"

[Steven Vits]

@Charlie Misonne thank you for the suggestion. I will check this first thing tomorrow. As I do get a value in the var iI assumed this was correct. It seemed like a newline value JSM was adding to the bearer token.

will keep you posted.

[Charlie Misonne]

And is what you are getting in the variable the expected value?

I'm doing the same, also to trigger a PowerAutomate flow and I did not have to deal with any newlines in the response.

I'm not storing the token in a variable first. I use the smart value directly as Authorization header. Perhaps this can cause a difference.

[Steven Vits]

This is what the rule looks like:

getting the acces key

storing the key in a variable and audit log for troubleshooting:

And the get action, I also tried with post (also changed in power automate off course)

And the audit log itself:

[Charlie Misonne]

Hi Steven,

Have you tried using the token logged by the automation rule in postman? Does it work?

My setup is the same except for the initial call to get the token.

In the payload (custom data) I did not URL encode the data. I'm just using this:

grant_type=client_credentials&scope=https://service.flow.microsoft.com//.default

I also noticed your "scope" is different". Not sure why the reason for that is.

An improvement but certainly not related to your issue:

Again in the custom data: I do not provide client_secret and client_id because you can not encrypt/ mask that part in the automation rule.

The endpoint also supports the Authorization header with the value <client_id>:<client_secret> encoded with base 64.

So:

[Steven Vits]

found the issue:

in the post action to get the acces token the 'scope' was not correct. it stated https://graph.microsoft.com/.default instead of https://service.flow.microsoft.com//.default

thank you all for the needed help and overthinking.

[Charlie Misonne]

Yes that' what I also found out when comparing our setups.

I remember I had to do a lot of troubleshooting back then when I created this rule.

I'm glad I could help! Please mark the answer as accepted to close off this topic :-)

[Steven Vits]

Thank you again, just tested with the base 64 encoded authorization header and it works perfect. security boosted! Now finding a way to call an key vault and it would approach perfection.

[Charlie Misonne]

Great! I really try to avoid having plain text secrets in the automation rules.

Anyone with permissions to see (or export!) rules will gain access to the values.

When you integrate with key vault let me know! This is something I also planned to do in the future.

[Marc -Devoteam-]

Hi @Steven Vits 

As you are making a call to a Microsoft endpoint, this is providing the 401, not the automation rule in Jira.

So the authorization towards MS not working.

It also states this in the error "The provided authentication token is not valid, token signature is not properly formatted"

Check what authorization is needed at the MS side?

Also to get a token from MS, you first need to be logged in on the MS side, to get an oauth token.

The call you are making is not authorized, with the provided credentials in the post action.

[Steven Vits]

@Marc -Devoteam- , thanks for the reply, the first pist action to Microsoft is succesfull and I do get a reply. Also using postman all is working like it should be.

the second http action should start a power automate flow with the auth token from tje app registration. 

[Marc -Devoteam-]

Hi @Steven Vits 

Have you provided the right headers in the web request in the automation rule.

Postman has many headers set by default, but the web request action not, are the right headers provided to make the call to the MS endpoint?