PnP Core from API using OBO

[planetpallavi]

I am developing an API that will use PnP Core to retrieve info from SharePoint.
The client application will call the API passing the bearer token (acquired from Azure AD).

I keep getting error --> Invalid JWT token: header is malformed.

I have followed sample to build a service using PnP Core instead --> https://github.com/Azure-Samples/active-directory-dotnet-native-aspnetcore-v2/tree/master/2.%20Web%20API%20now%20calls%20Microsoft%20Graph

What am I doing wrong?

PnP Core OBO - I am doing below
string configClientid = _config.GetSection("AzureAd:ClientId").Value;
string configTenantid = _config.GetSection("AzureAd:TenantId").Value;
string configClientSecret = _config.GetSection("AzureAd:ClientSecret").Value;

        var securedClientSecret = new SecureString();
        foreach (char c in configClientSecret)
        {
            securedClientSecret.AppendChar(c);
        }

        Task<PnPContext> pnpctx = _pnpContextFactory.CreateAsync(siteUrl,
            new OnBehalfOfAuthenticationProvider(clientId: configClientid
                                                , tenantId: configTenantid
                                                , clientSecret: securedClientSecret
                                                , () => Request.Headers.Authorization
                                                ));
        return await pnpctx;

[jansenbe]

@planetpallavi : This sample (https://spblog.net/post/2020/12/10/how-to-access-sharepoint-data-from-azure-function-with-spfx-and-pnp-core) shows how to use OBO from an SPFX web part. Looking at the code I noticed it passes the token as Request.Headers.Authorization.Parameter whereas you use Request.Headers.Authorization. Can you check if that makes a difference?

[planetpallavi]

Hello Jansenbe,

Thank you for your reply.
I did refer to that article, but .Parameter wasn't available to be used in the C# code, so wasn't sure... although the token was received all OK when I set the debug point there.

[planetpallavi]

Few additional queries though...

• If I am using PnP OBO, do I still need to add below in svc pipeline
  services.AddMicrosoftIdentityWebApiAuthentication(Configuration)
  .EnableTokenAcquisitionToCallDownstreamApi()
  .AddMicrosoftGraph(Configuration.GetSection("DownstreamApi"))
  .AddInMemoryTokenCaches();
• following on above, if I have the user token, I could potentially use a completely different App ID (with relevant API permissions) and not necessarily the middle-tier API service App ID? Is my understanding correct ?

[jansenbe]

@planetpallavi : not sure about the first question, I would need to build a repro for that. For the second question yes, you can use two different apps.

[planetpallavi]

So I did figure out eventually... The function needs the usertoken which can be retrieved by using AuthenticationHeaderValue.Parse(Request.Headers.Authorization).Parameter

PnP OBO works like a charm...

I also had this in my API service pipeline
builder.Services.AddMicrosoftIdentityWebApiAuthentication(config)
.EnableTokenAcquisitionToCallDownstreamApi()
.AddMicrosoftGraph(config.GetSection("DownstreamApi"))
.AddInMemoryTokenCaches();