OneDrive: 'account loading...'

Describe the bug: just after rolling out this extension for more users, it seems there’s an issue between Authenticator and OneDrive. The backup page is stuck on ‘account - loading…’

Perhaps something changed on OneDrive, or perhaps it’s a bug; how do we debug this?

Platform: Windows 10

• Browser: Chrome, FireFox
• Browser Version: latest versions

In Azure’s audit logs, we do see a lot of “app role assignment grant to user” failures (Microsoft.Online.DirectoryServices.UniqueKeyPropertyException)

With my personal/private OneDrive account, it works as expected; but not within our corporate O365 environment.

---

After I explicitly sign out and then sign in again, this appears in the debugger:

Error 403 - XHR GET https://graph.microsoft.com/v1.0/me/drive/special/approot

Request

Accept-Encoding | gzip, deflate, br
-- | --
Accept-Language | en-US,en;q=0.5
Authorization | Bearer   <redacted>
Connection | keep-alive
Cookie | s_preRef=%5B%5B%27neowin.net%27%2C%271492531998951%27%5D%5D;  s_fid=1DB9DB9943B5A8EF-1329F236115FC0EE;  _ga=GA1.2.1340837329.1525429298; LPVID=BkZWMyMWJiOTZjMzdhZWE5;  mbox=PC#b4abd76be1114733b279653e440d54b7.37_0#1677239875\|session#e6381b68c4914f58b5d0e3e2fa11f6ce#1613996935;   MC1=GUID=e539776adb3b46ccb03fb00329f2a55d&HASH=e539&LV=202002&V=4&LU=1580719930235;  MUID=246626B83BF46FDE02132CD03FF46C26; MSCC=1614337854;  mslocale={'u':'nl-be'}
Host | graph.microsoft.com

Response

{
  "error": {
    "code": "accessDenied",
    "message": "Access denied",
    "innerError": {
      "date": "2021-03-24T10:08:39",
      "request-id": "b65d8e4a-064f-4465-a4ac-0d8ec86b1206",
      "client-request-id": "b65d8e4a-064f-4465-a4ac-0d8ec86b1206"
    }
  }
}

Potentially related:

• https://github.com/OneDrive/onedrive-api-docs/issues/682
• https://docs.microsoft.com/en-US/onedrive/developer/rest-api/concepts/direct-endpoint-differences?view=odsp-graph-online#permissions -> seems like there’s a 2.0 version?
• https://docs.microsoft.com/en-us/graph/permissions-reference#remarks-5 -> see remark: The Files.ReadWrite.AppFolder delegated permission is only valid for personal accounts and is used for accessing the App Root special folder with the OneDrive Get special folder Microsoft Graph API.

[mymindstorm]

To sign in OneDrive for Business requires AAD app

We are using a MS Graph app which I believe can be autohized at an org level like @jbostoen has done.

What would the perfect approach be?

The perfect approach here would be to integrate this all into the OneDrive option automatically. In that case, we would need to request extra permissions if the tenant id indicates that it is a business account.

I think we should just add a button (e.g. “Sign In” and “Sign In (Business)”) to the onedrive page and store something if business was chosen.

According to this:

To have your own app’s folder, you must request either the Files.ReadWrite.AppFolder or Files.ReadWrite permission scope when getting an access token. For more details, see authentication. Note, Business OneDrive accounts do not currently support the Files.ReadWrite.AppFolder permission.

After testing this PR on my development 365 subscription, I think that the permissions are the only thing that need to be changed. So, all that would need to be done is to check whether to use Files.ReadWrite.AppFolder or Files.ReadWrite when needed.

[Sneezry]

Most important aspect is Files.ReadWrite.AppFolder becoming Files.ReadWrite.All

Files.ReadWrite should be enough.