title: Access token validation failure when creating Microsoft Graph webhook using the "Web API on-behalf-of flow"
body: <p>What I am trying to do is to use the "Web API on-behalf-of flow" scenario Microsoft described in <a href="https://docs.microsoft.com/en-au/azure/active-directory/develop/active-directory-v2-limitations" rel="nofollow noreferrer">this article</a> to create a web hook.</p>
  
  <p>So I started with the <a href="https://github.com/Azure-Samples/active-directory-dotnet-webapi-onbehalfof" rel="nofollow noreferrer">Microsoft github example</a> and made sure that I can successfully get the users profile via the Graph API.</p>
  
  <p>Then I modified the code where it gets the users profile to create the web hook, so the code looks like this:</p>
  
  <pre><code>// Authentication and get the access token on behalf of a WPF desktop app.
  // This part is unmodified from the sample project except for readability.
  
  const string authority = "https://login.microsoftonline.com/mycompany.com";
  const string resource = "https://graph.windows.net";
  const string clientId = "my_client_id";
  const string clientSecret = "my_client_secret";
  const string assertionType = "urn:ietf:params:oauth:grant-type:jwt-bearer";
  
  var user = ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value;
  var authenticationContext = new AuthenticationContext(authority,new DbTokenCache(user));
  var assertion = ((BootstrapContext) ClaimsPrincipal.Current.Identities.First().BootstrapContext).Token;
  var userName = ClaimsPrincipal.Current.FindFirst(ClaimTypes.Upn) != null
      ? ClaimsPrincipal.Current.FindFirst(ClaimTypes.Upn).Value
      : ClaimsPrincipal.Current.FindFirst(ClaimTypes.Email).Value;
  
  var result = await authenticationContext.AcquireTokenAsync(resource,new ClientCredential(clientId,clientSecret),new UserAssertion(assertion,assertionType,userName));
  
  var accessToken = result.AccessToken;
  
  
  // After getting the access token on behalf of the desktop WPF app,
  // subscribes to get notifications when the user receives an email.
  // This is the part that I put in.
  
  var subscription = new Subscription
  {
      Resource = "me/mailFolders('Inbox')/messages",
      ChangeType = "created",
      NotificationUrl = "https://mycompany.com/subscription/listen",
      ClientState = Guid.NewGuid().ToString(),
      ExpirationDateTime = DateTime.UtcNow + new TimeSpan(0, 0, 4230, 0)
  };
  
  const string subscriptionsEndpoint = "https://graph.microsoft.com/v1.0/subscriptions/";
  var request = new HttpRequestMessage(HttpMethod.Post, subscriptionsEndpoint);
  
  var contentString = JsonConvert.SerializeObject(subscription, new JsonSerializerSettings { NullValueHandling = NullValueHandling.Ignore });
  request.Content = new StringContent(contentString, System.Text.Encoding.UTF8, "application/json");
  request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
  request.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
  
  var response = await new HttpClient().SendAsync(request);
  
  if (response.IsSuccessStatusCode)
  {
      // Parse the JSON response.
      var stringResult = await response.Content.ReadAsStringAsync();
      subscription = JsonConvert.DeserializeObject&lt;Subscription&gt;(stringResult);
  }
  </code></pre>
  
  <p>The error I get from the response is:</p>
  
  <pre><code>{
   "error":
   {
      "code": "InvalidAuthenticationToken",
      "message": "Access token validation failure.",
      "innerError":
      {
        "request-id": "f64537e7-6663-49e1-8256-6e054b5a3fc2",
        "date": "2017-03-27T02:36:04"
      }
    }
  }
  </code></pre>
  
  <p>The webhook creation code was taken straight from the <a href="https://github.com/microsoftgraph/aspnet-webhooks-rest-sample" rel="nofollow noreferrer">ASP.NET webhook github sample project</a>, which, I have also made sure that I can run successfully.</p>
  
  <p>The same access token code works with the original user profile reading code:</p>
  
  <pre><code>// Call the Graph API and retrieve the user's profile.
  
  const string requestUrl = "https://graph.windows.net/mycompany.com/me?api-version=2013-11-08";
  request = new HttpRequestMessage(HttpMethod.Get, requestUrl);
  request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
  var response = await new HttpClient().SendAsync(request);
  </code></pre>
  
  <p>So I want to find out:</p>
  
  <ol>
  <li>Is creating a webhook via the graph API using the on-behalf-of flow even supported? Not sure if <a href="https://stackoverflow.com/questions/33975044">this SO question</a> is what I'm looking for here.</li>
  <li>If it is supported, what am I missing here?</li>
  <li>If it is not supported, is there an alternative to achieve it? E.g. is there anything from the existing Office 365 API that I can use?</li>
  </ol>