title: Authenticating Microsoft EWS using Nodejs over SOAP with x509 certificate
body: <p>I have had great success with the Microsoft Graph API to access users etc etc within Azure Active Directory, however two things that still require EWS and SOAP are retrieving user photos and adding a mail rule to a users mail account.
  I'm using Service accounts for everything, and impersonating an account admin to make requests.</p>
  
  <p>After attempting to use the same access token that I am using against the Graph API, I receive the error:
  <code>The access token is acquired using an authentication method that is too weak to allow access for this application. Presented auth strength was 1, required is 2</code>.</p>
  
  <p>Reading around, I understand that because EWS requires full privileges against the accounts, you can't just pass the access token, but you also have to "do something" with an x509 certificate.</p>
  
  <p>In my registered app, within Azure, I have adjusted the manifest so to include a self signed certificate so that I have:</p>
  
  <pre><code> "keyCredentials": [{
    "customKeyIdentifier": "lhbl...../w0bjA6l1mQ8=",
    "keyId": "774D2C35-2D58-.....-AC34B15472BA",
    "type": "AsymmetricX509Cert",
    "usage": "Verify",
    "value": "MIIFtTCCA52gAwIB.....mmgufQ2rW5GSjEEXOlO1c7qw=="
  }],
  </code></pre>
  
  <p>My understanding is the <code>customKeyIdentifier</code> is the Base64 of the key, from the command: <code>echo $(openssl x509 -in cert.pem -fingerprint -noout) | sed 's/SHA1 Fingerprint=//g' | sed 's/://g' | xxd -r -ps | base64</code></p>
  
  <p>the <code>value</code> is literally the key content, with the <code>-----BEGIN CERTIFICATE-----</code> and <code>-----END CERTIFICATE-----</code> removed, and all new lines removed too (otherwise in the manifest, the json isn't valid).</p>
  
  <p>The <code>keyId</code> is a GUID I just generated on the terminal with the <code>uuidgen</code> command, I don't <em>think</em> its related directly to the certificate in any way.</p>
  
  <p>What I'm not sure then, is what I have to change within my code, that is going to try to auth against EWS.</p>
  
  <p>I have started out with the <a href="https://www.npmjs.com/package/node-ews" rel="nofollow noreferrer">node-ews</a> library, my configuration looks like:</p>
  
  <pre><code>var ewsConfig = {
  username: userEmail,
  token: self.accessToken,
  host: 'https://outlook.office365.com/EWS/Exchange.asmx',
  auth: 'bearer'
  };
  var ews = new EWS(ewsConfig);
  var ewsFunction = 'UpdateInboxRules';
  ews.run(ewsFunction, ewsArgs)
    .then(result =&gt; {
      cb(null, result)
    })
    .catch(err =&gt; {
      cb(err);
    });
  };
  </code></pre>
  
  <p><code>self.accessToken</code> is the same token that I receive when accessing the Microsoft Graph API.</p>
  
  <p>So, in conclusion, my questions are:</p>
  
  <ol>
  <li>What do I need to do to my request so that I am telling the server to also auth the x509 certificate, I read that I may need to convert it to  a PKCS12 certicificate also?</li>
  <li>Can I use the same accessToken that I am successfully using to access the graph api?</li>
  <li>Is there a code snippet anywhere for Nodejs doing this?</li>
  <li>Is the <code>keyId</code> ok to be any identifier I want to give it?</li>
  </ol>
  
  <p>The response I get back contains:</p>
  
  <pre><code>{ 'content-length': '0',
          server: 'Microsoft-IIS/8.5',
          'request-id': '9b0d7a1b-85e6-40f6-9af0-7f65fc6669dc',
          'x-calculatedfetarget': 'MM1P123CU001.internal.outlook.com',
          'x-backendhttpstatus': '401, 401',
          'set-cookie': [Object],
          'x-feproxyinfo': 'MM1P123CA0026.GBRP123.PROD.OUTLOOK.COM',
          'x-calculatedbetarget': 'MM1P123MB1337.GBRP123.PROD.OUTLOOK.COM',
          'x-ms-diagnostics': '2000001;reason="The access token is acquired using an authentication method that is too weak to allow access for this application. Presented auth strength was 1, required is 2.";error_category="invalid_token"',
          'x-diaginfo': 'MM1P123MB1337',
          'x-beserver': 'MM1P123MB1337',
          'x-feserver': 'MM1P123CA0026, VI1PR0701CA0059',
          'x-powered-by': 'ASP.NET',
          'www-authenticate': 'Bearer client_id="00000002-0000-0ff1-ce00-000000000000", trusted_issuers="00000001-0000-0000-c000-000000000000@*", token_types="app_asserted_user_v1 service_asserted_app_v1", authorization_uri="https://login.windows.net/common/oauth2/authorize", error="invalid_token",Basic Realm="",Basic Realm="",Basic Realm=""',
          date: 'Tue, 02 May 2017 18:08:54 GMT',
          connection: 'close' } }
  </code></pre>
  
  <p>Thanks, much appreciated</p>