AADSTS50001: Getting exception while trying to access token from Azure AD by using ADAL from Console client

Sai picture Sai · Apr 1, 2014 · Viewed 9.7k times · Source

Getting exception while trying to access token from Azure AD by using ADAL from Console client.

Steps:

  1. I have configured Azure AD with my Web API application localhost:44307.
  2. Added the required configuration for Client Id, Client Key.
  3. Followed the work around by changing manifest suggested in this link. https://www.google.com/search?q=AADSTS50001+%2B+azure+AD+athentication&oq=AADSTS50001+%2B+azure+AD+athentication&aqs=chrome..69i57.10202j0j7&sourceid=chrome&espv=210&es_sm=93&ie=UTF-8#q=AADSTS50001&safe=active

ADAL Version Using: Microsoft.IdentityModel.Clients.ActiveDirectory 2.6.0-alpha

Console App Code:

void GetToken()
{
    clientId = "be6b055a-4efc-222a-2187-49657e6f4f1b";
    string ClientKey = "c/uIMlsqn9SzJLKKyBle42Ym+tgcaC2tbMlWxJQawE";
    string ClientCredential clientCred = new ClientCredential(clientId, ClientKey);

    authenticationContext = new AuthenticationContext("https://login.windows.net/MyDevAD.onmicrosoft.com");                
    authenticationResult = authenticationContext.AcquireToken("https://mylocalwebapiapp.com/", clientCred);
    ....
}

Fiddler Input:

POST https: //login.windows.net/MyDevAD.onmicrosoft.com/oauth2/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
client-request-id: 53262b17-1234-4ed9-bdb3-748d332eb44b
return-client-request-id: true
x-client-SKU: .NET
x-client-Ver: 2.6.0.0
x-client-CPU: x64
x-client-OS: Microsoft Windows NT 6.3.9600.0
Host: login.windows.net
Content-Length: 185
Expect: 100-continue
Connection: Keep-Alive

grant_type=client_credentials&resource=https%3A%2F%2Flocalhost%3A44307%2F&client_id=be6b055a-4efc-408a-8187-42137e6f4f1b&client_secret=c%2FuIMlsqn9SzJLKKyBle123Ym%2BtgcaC3tbMlWxJQawE%3D

Fiddler Output:

HTTP/1.1 400 Bad Request
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: application/json; charset=utf-8
Expires: -1
Set-Cookie: x-ms-gateway-slice=ProductionB; path=/
x-ms-request-id: e89741b2-570d-44f6-9e71-6533b083abcd
client-request-id: 35262b17-4771-4ed9-bdb3-748d332eb33b
X-Content-Type-Options: nosniff
X-Powered-By: ARR/3.0
X-Powered-By: ASP.NET
Date: Tue, 01 Apr 2014 19:05:51 GMT
Content-Length: 438

{"error":"invalid_resource","error_description":"AADSTS50001: Resource 'https://mylocalwebapiapp.com/' is not registered for the account.\r\nTrace ID: e89741b2-570d-44f6-9e71-6533b083cdad\r\nCorrelation ID: 35262b17-4771-4ed9-cddb3-748d332eb44b\r\nTimestamp: 2014-04-01 19:05:53Z","error_codes":[50001],"timestamp":"2014-04-01 19:05:53Z","trace_id":"e89741b2-570d-44f6-9e71-6533b083cdad","correlation_id":"35262b17-4771-4ed9-bdb3-748d332eb44b"}

Note: Posted URLS and ID's are faked ones.

Answer

vibronet picture vibronet · Jun 24, 2014

We should not have introduced any changes. I would recommend to double check that you assigned to your client app the correct permissions for accessing your web API. Please note that your app is getting a token with its own credentials, hence you need to assign app permissions directly (as opposed to delegated permissions). HTH V.