Call web services using Microsoft Security Tokens

1 How it works

These sample PowerShell scripts show how to call the SoftwareCentral web API with a Microsoft access token, as an Azure app or as a user.

Call as	What it can reach
An app	It is treated as an administrator in SoftwareCentral, with full access to every web service and resource. Use the same app registration (client ID) as SoftwareCentral uses; see Configuration → Intune Configuration → Manage Intune Tenants.
A user	It can only manage the resources assigned to the user's security roles. Assign the web service to the user's security role under Settings / Web Services.

Install the MSAL.PS module first, from an administrative PowerShell session: Install-Module -name MSAL.PS. Instead of a client secret you can use a certificate; note that certificates created by SoftwareCentral cannot be used for this, you must provide your own. The scripts hold the client secret and the password in the script to keep the example short. Do not do that in real use.

2 Call as an app

The first script calls Entra ID - Get Groups and sends two parameters as JSON.

Entra ID - Get Groups example

# Script example for calling the SoftwareCentral WebApi as an app.
# When calling as an app, it will be treated as an administrator in SoftwareCentral with full access to every web service and resource.

# Install the MSAL.PS Module from an administrative PowerShell session using:
# Install-Module -name MSAL.PS

# Web Service Parameters Start
[String]$strStartsWith = "[String]"
[String]$strIntuneTenantName = "Default"
# Web Service Parameters End

# Provide the URL for the SoftwareCentral web service.
$url = 'https://swc/Api/WS_AzureActiveDirectory.asmx/GetAllowedGroups'

# Provide your Intune Tenant Id "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx".
$tenantId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

# Provide your Intune Client Id "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx".
# Use the same app registration (ClientID) as SoftwareCentral uses. See Configuration -> Intune Configuration -> Manage Intune Tenants.
$clientId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

# Provide a client secret for the app. Do not store the client secret in the script in a real world scenario.
$clientSecret = "xxxxx~xxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

# Use a certificate instead of a client secret. Remember to change the MsalParams to use the clientCertificate instead of the clientSecret.
# Note that certificates created by SoftwareCentral cannot be used for this. You must provide your own certificate.
# This example uses a certificate stored in Cert:\LocalMachine\My.
# Provide the thumbPrint for the certificate.
#$thumbPrint = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
#$clientCertificate = Get-Item "Cert:\LocalMachine\My\$($thumbPrint)";

# The Msal parameters.
$MsalParams = @{
   ClientId = $clientId
   TenantId = $tenantId
   Scopes = "https://graph.microsoft.com/.default"
   ClientSecret = ConvertTo-SecureString $clientSecret -AsPlainText -Force
   #ClientCertificate = $clientCertificate
}

# Get an access token.
$MsalResponse = Get-MsalToken @MsalParams
$AccessToken = $MsalResponse.AccessToken

# Create an HttpClient and add the access token to the authentication header.
$client = New-Object System.Net.Http.HttpClient
$client.DefaultRequestHeaders.Authorization = New-Object System.Net.Http.Headers.AuthenticationHeaderValue('Bearer', $AccessToken)

# Create the json body for the web service.
$body = @{
    strStartsWith = $strStartsWith
    strIntuneTenantName = $strIntuneTenantName
} | ConvertTo-Json

# Perform a POST and wait for the response
$content = [System.Net.Http.HttpRequestMessage]::new()
$content.Headers.Add('Accept','application/json')
$content.Content = [System.Net.Http.StringContent]::new($body, [System.Text.Encoding]::UTF8,'application/json')
$content.Method = 'POST'
$content.RequestUri = $url
$clientResultMessage = $client.SendAsync($content).
    GetAwaiter().
    GetResult()
$result =  $clientResultMessage.
    Content.
    ReadAsStringAsync().
    GetAwaiter().
    GetResult()

# Uncomment to print result as a string.
#$result | ConvertFrom-Json

# Uncomment to print the Json result to the console.
$result

Call hello world as an app.

Hello World

# Script example for calling the SoftwareCentral WebApi as an app.
# When calling as an app, it will be treated as an administrator in SoftwareCentral with full access to every web service and resource.

# Install the MSAL.PS Module from an administrative PowerShell session using:
# Install-Module -name MSAL.PS

# Provide the URL for the SoftwareCentral web service.
$url = 'https://swc/Api/WS_HelloWorld.asmx/HelloWorld'

# Provide your Intune Tenant Id "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx".
$tenantId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

# Provide your Intune Client Id "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx".
# Use the same app registration (ClientID) as SoftwareCentral uses. See Configuration -> Intune Configuration -> Manage Intune Tenants.
$clientId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

# Provide a client secret for the app. Do not store the client secret in the script in a real world scenario.
$clientSecret = "xxxxx~xxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

# Use a certificate instead of a client secret. Remember to change the MsalParams to use the clientCertificate instead of the clientSecret.
# Note that certificates created by SoftwareCentral cannot be used for this. You must provide your own certificate.
# This example uses a certificate stored in Cert:\LocalMachine\My.
# Provide the thumbPrint for the certificate.
#$thumbPrint = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
#$clientCertificate = Get-Item "Cert:\LocalMachine\My\$($thumbPrint)";

# The Msal parameters.
$MsalParams = @{
   ClientId = $clientId
   TenantId = $tenantId
   Scopes = "https://graph.microsoft.com/.default"
   ClientSecret = ConvertTo-SecureString $clientSecret -AsPlainText -Force
   #ClientCertificate = $clientCertificate
}

# Get an access token.
$MsalResponse = Get-MsalToken @MsalParams
$AccessToken = $MsalResponse.AccessToken

# Create an HttpClient and add the access token to the authentication header.
$client = New-Object System.Net.Http.HttpClient
$client.DefaultRequestHeaders.Authorization = New-Object System.Net.Http.Headers.AuthenticationHeaderValue('Bearer', $AccessToken)

# Create the json body for the web service.
$body = @{
} | ConvertTo-Json

# Perform a POST and wait for the response
$content = [System.Net.Http.HttpRequestMessage]::new()
$content.Headers.Add('Accept','application/json')
$content.Content = [System.Net.Http.StringContent]::new($body, [System.Text.Encoding]::UTF8,'application/json')
$content.Method = 'POST'
$content.RequestUri = $url
$clientResultMessage = $client.SendAsync($content).
    GetAwaiter().
    GetResult()
$result =  $clientResultMessage.
    Content.
    ReadAsStringAsync().
    GetAwaiter().
    GetResult()

# Uncomment to print result as a string.
#$result | ConvertFrom-Json

# Uncomment to print the Json result to the console.
$result

3 Call as a user

Call hello world as a user.

Hello World

# Script example for calling the SoftwareCentral WebApi as a user.
# When calling as a user, it will only be allowed to manage resources assigned to this users security roles.
# Remember to assign the web service to users security role under "Settings / Web Services".

# Install the MSAL.PS Module from an administrative PowerShell session using:
# Install-Module -name MSAL.PS

# Specify user credentials. Do not store the password in the script in a real world scenario. You can eg. use Azure Key Vault.
$username = "username@domain.onmicrosoft.com"
$password = "password"

# Provide the URL for the SoftwareCentral web service.
$url = 'https://swc/Api/WS_HelloWorld.asmx/HelloWorld'

# Provide your Intune Tenant Id "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx".
$tenantId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

# By default, use the Microsoft Graph PowerShell app id "14d82eec-204b-4c2f-b7e8-296a70dab67e". If needed, you can use your own Azure AD App Id.
$clientId = "14d82eec-204b-4c2f-b7e8-296a70dab67e"

$securePwd = ConvertTo-SecureString $password -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential ($username, $securePwd)

$MsalParams = @{
   ClientId = $clientId
   TenantId = $tenantId
   Scopes   = 'openid','profile'
   UserCredential = $Cred
}

$MsalResponse = Get-MsalToken @MsalParams -UserCredential $Cred
$AccessToken = $MsalResponse.AccessToken

# Create an HttpClient.
$client = New-Object System.Net.Http.HttpClient
$client.DefaultRequestHeaders.Authorization = New-Object System.Net.Http.Headers.AuthenticationHeaderValue('Bearer', $AccessToken)

# Perform a POST
$body = @{
} | ConvertTo-Json
$content = [System.Net.Http.HttpRequestMessage]::new()
$content.Headers.Add('Accept','application/json')
$content.Content = [System.Net.Http.StringContent]::new($body, [System.Text.Encoding]::UTF8,'application/json')
$content.Method = 'POST'
$content.RequestUri = $url
$clientResultMessage = $client.SendAsync($content).
    GetAwaiter().
    GetResult()
$result =  $clientResultMessage.
    Content.
    ReadAsStringAsync().
    GetAwaiter().
    GetResult()

# Uncomment to print result as a string.
#$result | ConvertFrom-Json

# Print the Json result to the console.
$result

4 Best practice

Use a user account when the script needs only some web services. A call as a user is only allowed for the web services that the user's AD group can use through a security role.
Check the log to see who made a call. Each call is logged with the web service name, the caller's IP address, and whether the caller was an app or a user.

5 Troubleshooting

Symptom	Cause	What to do
“User 'name' is not a member of any AD-Groups with access to this web service.” (in the log)	The user's AD group is not linked to a security role that may use this web service.	Add the user's AD group to a security role that has the web service, under Settings › Web Services.
“Failed to authorize connection to web service…” in the log.	The access check for the call failed. The error is written to the log as a critical entry.	Open the Log and read the entry with its error. Check that the script calls with the app or user you intended.