2052686 - Microsoft Graph server denies access with valid credentials in Thunderbird 152 only

Status: RESOLVED WORKSFORME

(MailNews Core :: Networking: Exchange, defect)

Description

[Matthew Tolbert]

Attachment: First tranche of requested permissions in Thunderbird 152.0.1

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0

Steps to reproduce:

I start by launching Thunderbird in a fresh profile.

Only needed for Thunderbird 152.0.1 and 153.0b5:

1. Hide the Account Hub popup
2. Open "Settings" under the hamburger menu
3. Scroll to the bottom and open the Config Editor
4. Toggle "mail.graph.enabled" to true
5. Choose "Email" under "Add Account" in the hamburger menu

Common steps:

1. Enter my education Microsoft 365 email address in the email address box
2. Choose "Continue"
3. Enter my password in the Microsoft login popup (not needed in Thunderbird 153.0b5 and 154.0a1, since the login window opens in my browser, where I'm already logged in)
4. Grant Thunderbird requested permissions (screenshot from Thunderbird 152.0.1 attached)
5. Complete Microsoft MFA (not needed in Thunderbird 153.0b5 and 154.0a1, since the login window opens in my browser, where I'm already logged in)
6. Choose "Exchange (Graph)" as the protocol (or "Microsoft Graph API" in Thunderbird 154.0a1)
7. Choose "Continue"
8. In the pop-up, grant Thunderbird three more requested permissions (or five in Thunderbird 153.0b5 and 154.0a1)

Actual results:

1. Pop-up for Microsoft closes
2. Account Hub shows the ending screen with the "Finish" button
3. Receive a desktop notification from Thunderbird: "Server graph.microsoft.com responded with an error."
4. If I close Account Hub and open the Activity Manager, I see the message "Server graph.microsoft.com responded with an error."
5. Thunderbird outputs the following to the console from which it was launched:

[ERROR protocol_shared::operation_sender] Request 1fa58d9f-8539-4626-8e12-ba78e15ef7bb FAILED with status 403: HTTP error (403)
[ERROR protocol_shared::safe_xpcom] an error occurred when performing operation sync folder hierarchy: Protocol(Http(StatusCode { status: StatusCode(403), response: Response { status: Ok(StatusCode(403)), body: "{\"error\":{\"code\":\"ErrorAccessDenied\",\"message\":\"Access is denied. Check credentials and try again.\"}}" } }))

6. If I log into the Microsoft My Apps dashboard for this account, I see Thunderbird possesses all the permissions it requested, except "View your basic profile".

Expected results:

Instead of graph.microsoft.com responding with an error, I would have wanted to see my account populate, as it does if I select non-Owl Exchange in Thunderbird 152.0.1, Exchange (Graph) in Thunderbird 153.0b5, or Microsoft Graph API in Thunderbird 154.0a1.

Comment 1

[Matthew Tolbert]

For the avoidance of confusion, this bug does not seem to affect Thunderbird 153. It appears to only affect Thunderbird 152.

Comment 2

[Eleanor Dicharry]

Weird that it doesn't show "view your basic profile" even though that's clearly in the list of granted permissions in your screenshot. So everything works fine in 153? If so, I'll probably close this as wontfix since we landed quite a few changes in preparation for defaulting support to on in 154.

Comment 3

[Matthew Tolbert]

I haven’t checked what the permissions on My Apps look like on 153 or 154, but yes, it’s not there for 152.

Everything works fine in 153 and 154. Only 152 is affected.

Comment 4

[Magnus Melin [:mkmelin]]

Let's close then. v153 will be out in two weeks and this wouldn't get fixed in 152 either way.