We are currently integrating RSA Governance & Lifecycle (IGL) with Microsoft Entra ID using the AFX Entra ID Connector.

For the Microsoft Graph API call, we are using the RESTful Web Service configuration/HTTP Request within the AFX connector to invoke the Microsoft Graph API.

The OAuth 2.0 authentication has been configured and the API was tested successfully using Postman. However, when the request is executed through the RSA AFX connector, the following error occurs.

Error

HTTP POST on resource 'https://graph.microsoft.com:443/v1.0/users'

failed: unauthorized (401)

Error type: HTTP:UNAUTHORIZED

The failure occurs at the HTTP/HTTPS Request processor:

AFX-CONN-EntraId-Connector.xml:824

(HTTP/HTTPS Request)

The request being executed is:

POST https://graph.microsoft.com/v1.0/users

Current Configuration

We are using the RESTful Web Service/HTTP Request functionality in the AFX Entra ID Connector to invoke Microsoft Graph.

The request headers are being constructed dynamically using:

vars.header ++ {"Content-Length": vars.contentLength}

Expected Behavior

The RESTful Web Service request should successfully authenticate with Microsoft Graph and execute the "POST /v1.0/users" operation.

Actual Behavior

Microsoft Graph returns:

401 Unauthorized

Assistance Required

Could the RSA Community/Engineering team please help us identify the reason for the 401 response when using the RESTful Web Service connector?

In particular, we would like to confirm:

1. Whether the OAuth 2.0 access token is being passed correctly to the RESTful Web Service request.

2. Whether the "Authorization: Bearer <access_token>" header needs to be configured explicitly.

3. Whether there is any specific RSA AFX configuration required when invoking Microsoft Graph APIs through the RESTful Web Service connector.

4. Whether there are any known issues with the RESTful Web Service connector and Microsoft Graph "POST /v1.0/users".

5. What debug logging can be enabled to verify the outgoing HTTP headers/token without exposing sensitive credentials.

The same OAuth configuration/API was tested through Postman, so we would like to understand whether the issue is related to how the token or Authorization header is being handled by the RSA AFX RESTful Web Service request.

Sensitive credentials and access tokens can be provided only in masked form if required.