Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Cannot specify more than one scope in New-PartnerAccessToken cmdlet despite it having "scopes"

See original GitHub issue

Steps to reproduce

[String[]]$ScopesTest = 'https://api.partnercenter.microsoft.com/user_impersonation'
[String[]]$ScopesTest += 'https://management.azure.com/user_impersonation'

PS C:\Windows\system32> $ScopesTest
https://api.partnercenter.microsoft.com/user_impersonation
https://management.azure.com/user_impersonation

PS C:\Windows\system32> $RefreshTokenForTestingAuthSPNFull = New-PartnerAccessToken -ApplicationId 'xxxxx-xxxx-xxxx-xxxx-xxxx' -Scopes $ScopesTest -ServicePrincipal -Credential $Credentials -Tenant "xxx-xxx-xxx-xxx-xxxxx" -UseAuthorizationCode
WARNING: Attempting to launch a browser for authorization code login.
WARNING: We have launched a browser for you to login. For the old experience with device code flow, please run 'New-PartnerAccessToken -UseDeviceAuthentication'.
New-PartnerAccessToken : AADSTS28000: Provided value for the input parameter scope is not valid because it contains more than one resource. Scope 
https://api.partnercenter.microsoft.com/user_impersonation https://management.azure.com/user_impersonation offline_access openid profile is not valid.
Trace ID: 55a1357c-a6dd-4337-9b9f-473cbbe74200
Correlation ID: def32739-9e85-48fb-a4e2-8248d697d91f
Timestamp: 2019-09-26 11:08:05Z
At line:1 char:38
+ ... thSPNFull = New-PartnerAccessToken -ApplicationId 'xxx-xxx-xxx...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [New-PartnerAccessToken], MsalServiceException
    + FullyQualifiedErrorId : Microsoft.Identity.Client.MsalServiceException,Microsoft.Store.PartnerCenter.PowerShell.Commands.NewPartnerAccessToken

Expected behavior

Should add scopes to the authorisation but instead the code parses all the strings into the cmd.

GET /xxxx-xxx-xxxx-xxxx-xxxxx/oauth2/v2.0/authorize?scope=https:%2F%2Fapi.partnercenter.microsoft.com%2Fuser_impersonation+https:%2F%2Fmanagement.azure.com%2Fuser_impersonation+offline_access+openid+profile&response_type=code&client_id=xxxx-xxxx-xxxx-xxxx-xxxxxxx&redirect_uri=http:%2F%2Flocalhost:8400%2F&client-request-id=558d721e-afa2-4082-a5ac-8b3d8fb74033&x-client-SKU=MSAL.CoreCLR&x-client-Ver=3.0.8.0&prompt=select_account HTTP/1.1

Version:

PS C:\Windows\system32> Get-Module -Name PartnerCenter

ModuleType Version    Name                                ExportedCommands                                                                                              
---------- -------    ----                                ----------------                                                                                              
Script     2.0.1909.5 PartnerCenter                       {Add-PartnerCustomerCartLineItem, Add-PartnerCustomerUserRoleMember, Connect-PartnerCenter, Disconnect-Part...

Issue Analytics

State:
Created 4 years ago
Comments:9 (5 by maintainers)

Top GitHub Comments

3reactions

slavizhcommented, Nov 26, 2019

the cmdlet for token still does not accepts more than one scope. New-PartnerAccessToken : AADSTS28000: Provided value for the input parameter scope is not valid because it contains more than one resource. Scope https://api.partnercenter.microsoft.com/user_impersonation ht tps://management.azure.com/user_impersonation offline_access openid profile is not valid.

0reactions

aconn21commented, Jan 29, 2021

Why is this issue closed? I’m also experiencing the same problem. Unable to use more than 1 scope. Using version 3.0.10

Top Results From Across the Web

New-PartnerAccessToken (PartnerCenter)

The first command gets the service principal credentials (application identifier and service principal secret), and then stores them in the $credential variable ...

Microsoft Graph permission scopes throwing error when I ...

In your code, start by using a single value for your scopes e.g. Mail. Read and test that (i.e. obtain the token) first...

Connect to Exchange Online automated when MFA is ...

If I use the graph.microsoft.com url instead then no connections to Azure AD ot MSOnline etc will work. Any ideas. Kelvin Tegelaar •...

My Automations Break with GDAP: The Fix! -

In this article, I show you how to configure GDAP and app registrations so that you can continue to perform automations across customers....

On The Nature of OAuth2's Scopes

Debunking OAuth2 scopes and diving into use-cases of stretching scopes ... a scope cannot allow an application to do more than what the...