Acquiring OAuth2 access tokens for Exchange Management Shell cmdlets

Question

In our python application, we use the Exchange Management Shell cmdlets to perform some tasks. (In fact, the python application runs .Net application, which calls the Exchange Management Shell cmdlets.) Currently we use basic authentication with the New-PSSession cmdlet. On the other hand, we are already acquiring OAuth2 access tokens for different APIs and resources. Now we would like to use OAuth2 authentication with the Exchange Management Shell cmdlets.

We had a look at this article[1].

However we have a few questions:

1. Is there a way to get access tokens without using ADAL and MSAL?
2. Is there a way to get a new access token using a refresh token?
3. It seems there is no chance to use an external(system) browser, isn't there? Thank you in advance.

[1] https://developermessaging.azurewebsites.net/2018/09/07/acquiring-oauth2-access-tokens-for-automating-exchange-management-shell-cmdlets/?unapproved=96&moderation-hash=9250fbdda0e11fd8af9bafd4c3576139#review-96

Answer 1

Oh, in fact, everything is very simple:

1. Request for an authorization code: https://login.microsoftonline.com/common/oauth2/authorize?redirect_uri=http%3A%2F%2Flocalhost%3A55555&client_id=a0c73c16-a7e3-4564-9a95-2bdf47383716&response_type=code

2. Request for an access token:

   • URL: https://login.microsoftonline.com/common/oauth2/token
   • body: resource=https%3A%2F%2Foutlook.office365.com&client_id=a0c73c16-a7e3-4564-9a95-2bdf47383716&redirect_uri=http%3A%2F%2Flocalhost%3A9999&code=YOUR_AUTHORIZATION_CODE&client_secret=&grant_type=authorization_code

Answer 2

1. MSAL and ADAL are libraries which are designed for authenticating through OAuth and Yes you can get token without using MSAL or ADAL by directly using OAuth.you can directly use Oauth and OpenID Connect. It is very easy to code by managing Get and Post requests from URLs.
2. Refresh tokens are used to get a new access token when your current access token expires. For more information, see the document.
3. Using of a Browser depends on auth flow you are using. For example Device code flow does not require browser.