Develop Reference

Deleting a user from Azure Active Directory B2C Android/Java

I have an Android application in which I'm using Azure AD B2C to authenticate users. Users login and logout of the application as needed. I would like to give the user the option to delete their own account.
I understand that I need to use the Azure AD Graph API to delete the user. This is what I have so far:
According to this link, it looks like deleting a user from a personal account (which is what the B2C users are using) is not possible. Is that correct?
Here's my code snippet for the Graph API call. Feel free to ignore it if I'm off track and there is a better way to solve this.
I believe I need a separate access token than what my app currently has (as the graph API requires other API consent). So, I'm getting the access token as follows:
AcquireTokenParameters parameters = new AcquireTokenParameters.Builder()
.startAuthorizationFromActivity(getActivity())
.fromAuthority(B2CConfiguration.getAuthorityFromPolicyName(B2CConfiguration.Policies.get("SignUpSignIn")))
.withScopes(B2CConfiguration.getGraphAPIScopes())
.withPrompt(Prompt.CONSENT)
.withCallback(getGraphAPIAuthCallback())
.build();
taxApp.acquireToken(parameters);
In the getGraphAPIAuthCallback() method, I'm calling the Graph API using a separate thread (in the background):
boolean resp = new DeleteUser().execute(authenticationResult.getAccessToken()).get();
Finally, in my DeleterUser() AsyncTask, I'm doing the following:
#Override
protected Boolean doInBackground(String... aToken) {
final String asToken = aToken[0];
//this method will be running on background thread so don't update UI from here
//do your long running http tasks here,you dont want to pass argument and u can access the parent class' variable url over here
IAuthenticationProvider mAuthenticationProvider = new IAuthenticationProvider() {
#Override
public void authenticateRequest(final IHttpRequest request) {
request.addHeader("Authorization",
"Bearer " + asToken);
}
};
final IClientConfig mClientConfig = DefaultClientConfig
.createWithAuthenticationProvider(mAuthenticationProvider);
final IGraphServiceClient graphClient = new GraphServiceClient.Builder()
.fromConfig(mClientConfig)
.buildClient();
try {
graphClient.getMe().buildRequest().delete();
} catch (Exception e) {
Log.d(AccountSettingFragment.class.toString(), "Error deleting user. Error Details: " + e.getStackTrace());
}
return true;
}
Currently, my app fails when trying to get an access token with a null pointer exception:
com.microsoft.identity.client.exception.MsalClientException: Attempt to invoke virtual method 'long java.lang.Long.longValue()' on a null object reference
Any idea what I need to do to provide the user the option to users to delete their own account? Thank you!

Thanks for the help, #allen-wu. Due to his help, this azure feedback request and this azure doc, I was able to figure out how to get and delete users silently (without needing intervention).
As #allen-wu stated, you cannot have a user delete itself. So, I decided to have the mobile app call my server-side NodeJS API when the user clicks the 'Delete Account' button (as I do not want to store the client secret in the android app) and have the NodeJS API call the Azure AD endpoint to delete the user silently. The one caveat is that admin consent is needed the first time you try to auth. Also, I have only tested this for Graph API. I'm not a 100% sure if it works for other APIs as well.
Here are the steps:
Create your application in your AAD B2C tenant. Create a client secret and give it the following API permissions: Directory.ReadWrite.All ;
AuditLog.Read.All (I'm not a 100% sure if we need the AuditLog permission. I haven't tested without it yet).
In a browser, paste the following link:
GET https://login.microsoftonline.com/{tenant}/adminconsent?
client_id=6731de76-14a6-49ae-97bc-6eba6914391e
&state=12345
&redirect_uri=http://localhost/myapp/permissions
Login using an existing admin account and provide the consent to the app.
Once you've given admin consent, you do not have to repeat steps 1-3 again. Next, make the following call to get an access token:
POST https://login.microsoftonline.com/{B2c_tenant_name}.onmicrosoft.com/oauth2/v2.0/token
In the body, include your client_id, client_secret, grant_type (the value for which should be client_credentials) and scope (value should be 'https://graph.microsoft.com/.default')
Finally, you can call the Graph API to manage your users, including deleting them:
DELETE https://graph.microsoft.com/v1.0/users/{upn}
Don't forget to include the access token in the header. I noticed that in Postman, the graph api had a bug and returned an error if I include the word 'Bearer' at the start of the Authorization header. Try without it and it works. I haven't tried it in my NodeJS API yet, so, can't comment on it so far.
#allen-wu also suggested using the ROPC flow, which I have not tried yet, so, cannot compare the two approaches.
I hope this helps!

There is a line of code: graphClient.getUsers("").buildRequest().delete();
It seems that you didn't put the user object id in it.
However, we can ignore this problem because Microsoft Graph doesn't allow a user to delete itself.
Here is the error when I try to do it.
{
"error": {
"code": "Request_BadRequest",
"message": "The principal performing this request cannot delete itself.",
"innerError": {
"request-id": "8f44118f-0e49-431f-a0a0-80bdd954a7f0",
"date": "2020-06-04T06:41:14"
}
}
}

Android Management API change Policy for device

I created 2 policies in my enterprise.
I would like to switch one device to the other policy without re-enroling it.
I tried to use android management enterprises devices.patch with following JSON
{ "policyName": "policy2" }
this link
When i execute this command i always get follwoing error Message:
{
"error": {
"code": 400,
"message": "Illegal state transition from ACTIVE to DEVICE_STATE_UNSPECIFIED",
"status": "INVALID_ARGUMENT"
}
}
Does anybody know how to change policy for a device without wiping it?

It is indeed possible to change the policy of a device without re-enrolling it, and you're not far from the solution.
You get this error because you implicitly attempt to change other fields of the Device resource (in particular the state field) by not setting them in the resource that you send in devices.patch.
You have two options:
Set the updateMask in devices.patch to "policyName", to tell the API that you only want to change the policyName field.
Call devices.get to get the current Device resource, and then send back the entire resource with only the policyName field changed in to devices.patch.
Using updateMask is preferable because it does an atomic read-modify-write.

As Fred mentioned, updateMask is the preferred way to go. Here's an example of how to use the updateMask approach in the Google colab
swap_result = androidmanagement.enterprises().devices().patch(
name='enterprises/ENTERPRISE_NAME/devices/DEVICE_ID', updateMask='policyName', body={ "policyName": "enterprises/ENTERPRISE_NAME/policies/NEW_POLICY_NAME"}).execute()

i foudn a solution for my problem:
{ "policyName": "policy2" , "state":"active"}

If you try this from management api test site then add updateMask as "policyName"

Codename one GoogleConnect setScope is not effective

I am using the new GoogleConnect thing and set the scope like
Login gc = GoogleConnect.getInstance();
gc.setScope("https://www.googleapis.com/auth/plus.profile.emails.read https://www.googleapis.com/auth/drive https://www.googleapis.com/auth/drive.file");
...
gc.doLogin();
However, when the access token is generated and checked in
https://www.googleapis.com/oauth2/v1/tokeninfo?access_token=(accesstoken)
, it shows
"scope": "https://www.googleapis.com/auth/plus.me https://www.googleapis.com/auth/userinfo.profile"
Is it related to any recent updates or new build hint?
I am totally lost here. It is an Android build.
Thanks.
Edited to add gc.doLogin() code, to clarify that I am NOT trying to set the scope after the access token is generated.

Same problem here, setScope only works on the simulator
"scope": "https://www.googleapis.com/auth/plus.me https://www.googleapis.com/auth/userinfo.profile",
My scopes (for reference):
google.auth.scopes=https://www.googleapis.com/auth/plus.login https://www.googleapis.com/auth/plus.me email profile

How to Authenticate with Alexa Voice Service from Android?

I am trying to connect to Alexa Voice Service from an Android app following the directions on this page: https://developer.amazon.com/public/solutions/alexa/alexa-voice-service/docs/authorizing-your-alexa-enabled-product-from-an-android-or-ios-mobile-app
Bundle options = new Bundle();
String scope_data = "{\"alexa:all\":{\"productID\":\"" + PRODUCT_ID +
                    "\", \"productInstanceAttributes\": {\"deviceSerialNumber\":\"" + PRODUCT_DSN + "\"}}}";
options.putString(AuthzConstants.BUNDLE_KEY.SCOPE_DATA.val, scope_data);
options.putBoolean(AuthzConstants.BUNDLE_KEY.GET_AUTH_CODE.val, true);
options.putString(AuthzConstants.BUNDLE_KEY.CODE_CHALLENGE.val, CODE_CHALLENGE);
options.putString(AuthzConstants.BUNDLE_KEY.CODE_CHALLENGE_METHOD.val, "S256");
mAuthManager.authorize(APP_SCOPES, options, new AuthorizeListener());
First, I don't know what APP_SCOPES should be. I set it to:
protected static final String[] APP_SCOPE = new String[]{"profile", "postal_code"};
but I get an error from the server
AuthError cat= INTERNAL type=ERROR_SERVER_REPSONSE - com.amazon.identity.auth.device.AuthError: Error=invalid_scope error_description=An unknown scope was requested
What am I doing wrong and how can I do this right?

The APP_SCOPE is : "alexa:all"
The PRODUCT_DSN can be anything you want, "1234" as per suggestion from Joshua Frank (https://forums.developer.amazon.com/forums/message.jspa?messageID=18973#18973)
The PRODUCT_ID is the ID in the AVS Developper Portal (https://developer.amazon.com/edw/home.html#/avs/list)
The CODE_CHALLENGE the Client Secret in the Security Profile of your application (should be already hashed in S256)

The problem is not with the APP_SCOPES variable, it is actually with the PRODUCT_ID, PRODUCT_DSN variables passed in the scope data.
I faced this exact same issue and have raised a query in amazon developers forum on what needs to be passed in those variables - Alexa authentication issue using beta SDK
Once the PRODUCT_ID, PRODUCT_DSN & CODE_CHALLENGE variables are determined then the authentication should be pretty much straight forward.

The APP_SCOPE should be "alexa:all"

Facebook SDK : invalide scope : basic info use public_profile, user friends instead

I'm using facebook sdk 3.15 to set a facebook login button on my project.
keep in mind that I'm working with parse.com
I used the code provided by parse.com support, available here but I keep getting this error after I click on the login button :
invalide scope : basic info use public_profile, user friends instead
I googled the error and found nothing...
Thanks for your help :)

You're using Graph API v2.0, hence the permission basic_info is no longer available.
See https://developers.facebook.com/docs/apps/changelog#v2_0_permissions
basic_info is no longer available.
Check what you set as scope parameter in the Login URL.

I have the same problem,like the below image:
Then I change my code from: self.loginView.readPermissions = #[#"basic_info"]; to self.loginView.readPermissions = #[#"public_profile", #"user_friends"]; to solved the problem. With the loginView is declaration into the header file:#property (weak, nonatomic) IBOutlet FBLoginView *loginView;