5

I am trying to hit a post request to https://login.microsoftonline.com/<My_Tenant_Id>/oauth2/token from my Java Code, but I am getting the error "invalid_grant: AADSTS50126: Error validating credentials due to invalid username or password". I have verified the credentials and they are correct (I am able to login to Azure portal and see my AWS APP for SSO). I even tried hitting the same request from postman, but then also same issue.

The parameters I have passed are:

"grant_type", "password"
"requested_token_type","urn:ietf:params:oauth:token-type:saml2"
"username", username
"password", password
"client_secret", clientSecret
"client_id", clientId
"resource", clientId

I have even checked various Microsoft Documentations but I am still not able to resolve the issue. Can anybody tell what might be the issue. is the API call wrong or the server setup is wrong.

Please note: Initially my API call was working, but then I got an error invalid_request: AADSTS80014 then it automatically got resolved and I started getting invalid_grant: AADSTS50126. Has anybody faced this issue or knows how to fix this. Thanks!

sschmeck
  • 7,233
  • 4
  • 40
  • 67
Prateek
  • 141
  • 1
  • 1
  • 7
  • I use the same request body as yours. But it works fine for me. Could you provide a screenshot of the request (including request body and response) in Postman? Remember to remove the tenant id, client id, client secret, username and password in the screenshot. – Allen Wu Dec 09 '20 at 01:41
  • Do you still need help on this issue? – Allen Wu Dec 11 '20 at 02:35
  • Hi Allen, I am able to resolve this now. I created a cloud only user for Resource Owner password Grant flow and it worked as expected. Thanks! – Prateek Dec 14 '20 at 07:49
  • Glad to know that. Would you mind adding an answer to help others? – Allen Wu Dec 14 '20 at 07:55

1 Answers1

8

I am able to resolve this by creating a cloud only user. The reason a federated user fails with the Resource Owner Password Grant flow is because for a federated user Azure AD has to redirect the user to the specific federation Server that belongs to the user's on-prem domain so that the ADFS server can get the auth down with the local domain controller. In Resource Owner Password grant flow this redirect is not possible hence it is not able to validate the username and password and hence that error.

As a suggestion, we can create a new cloud only user whose username and password should reside in Azure AD, so that when using Resource Owner password Grant flow we submit the user's credentials, AAD can authenticate the user without any redirections.

This user can be a normal user in AAD and the respective delegated permissions should be present in the app registration. Now one more thing to make sure is, if the delegated permission that we are providing needs admin consent then before the user logs in to the application, the admin has to provide the admin consent to this delegated permission. If we want to the user to provide his/her own consent (if the delegated permission needs user consent) then we would have to somehow provide the user consent before going ahead with the Resource Owner Password Grant Flow.

Prateek
  • 141
  • 1
  • 1
  • 7