(Tcl) Microsoft Graph OAuth2 Client Credentials Grant Flow

Demonstrates how to get a Microsoft Graph access token using the Client Credentials Grant Flow.

You can use the OAuth 2.0 client credentials grant specified in RFC 6749, sometimes called two-legged OAuth, to access web-hosted resources by using the identity of an application. This type of grant is commonly used for server-to-server interactions that must run in the background, without immediate interaction with a user. These types of applications are often referred to as daemons or service accounts.

For more information, see https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow

Chilkat Tcl Extension Downloads Chilkat Tcl Extension Downloads

load ./chilkat.dll

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

set http [new_CkHttp]

set req [new_CkHttpRequest]

CkHttpRequest_AddParam $req "client_secret" "CLIENT_SECRET"
CkHttpRequest_AddParam $req "client_id" "CLIENT_ID"
# Don't know if the scopes valid for the client credentials grant are different than the scopes for the 3-legged Authorization Code Grant...
CkHttpRequest_AddParam $req "scope" "https://graph.microsoft.com/.default"
CkHttpRequest_AddParam $req "grant_type" "client_credentials"

# Use your own tenant ID, for example 4d8fdd66-66d1-43b0-ae5c-e31b4b7de5cd
set url "https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token"
# resp is a CkHttpResponse
set resp [CkHttp_PostUrlEncoded $http $url $req]
if {[CkHttp_get_LastMethodSuccess $http] != 1} then {
    puts [CkHttp_lastErrorText $http]
    delete_CkHttp $http
    delete_CkHttpRequest $req
    exit
}

set statusCode [CkHttpResponse_get_StatusCode $resp]
puts "Response status code = $statusCode"

set json [new_CkJsonObject]

CkJsonObject_Load $json [CkHttpResponse_bodyStr $resp]
delete_CkHttpResponse $resp

CkJsonObject_put_EmitCompact $json 0
puts [CkJsonObject_emit $json]

# Sample successful output:

# {
#   "token_type": "Bearer",
#   "expires_in": 3599,
#   "ext_expires_in": 3599,
#   "access_token": "eyJ0eX...K0jOERg"
# }

if {$statusCode == 200} then {
    CkJsonObject_WriteFile $json "qa_data/tokens/msGraphClientCredentialsToken.json"
    puts "Success."
} else {
    puts "Failed."
}


delete_CkHttp $http
delete_CkHttpRequest $req
delete_CkJsonObject $json