CODEWITHSUNDEEP
azureactive-directoryoauth-2.0
jwal
jwal

Reputation: 140

"The access grant authorization_code is not supported" from Azure AD using Oauth 2

I am in the middle of an Authorization Code Grant Flow with Azure AD. Even though the documentation says the grant_type should be authorization_code, I am getting an error message about this property.

POST https://login.windows.net/SOME_AZURE_AD_UUID/oauth2/token?api-version=1.0
Content-Type: application/x-www-form-urlencoded

client_id=SECRET_CLIENT_ID
&client_secret=SECRET_CLIENT_SECRET
&code=SECRET_CODE
&grant_type=authorization_code
&redirect_uri=https://myserver.example.com/login/auth_return
&resource=https://myserver.example.com/
&scope=openid email

(edit: whitespace added for clarity)

The error I am getting back:

HTTP/1.1 400 Bad request
Content-Length: 436
X-Content-Type-Options: nosniff
X-Powered-By: ASP.NET
Request-Id: SOME_REQUEST_ID
X-Ms-Request-Id: SOME_REQUEST_ID
Strict-Transport-Security: max-age=31536000; includeSubDomains
Set-Cookie: x-ms-gateway-slice=slicea; path=/; secure; HttpOnly, stsservicecookie=acs; path=/; secure; HttpOnly
Server: Microsoft-IIS/8.0
Cache-Control: private
Date: Wed, 20 Aug 2014 14:44:08 GMT
Content-Type: application/json; charset=utf-8

{
  "correlation_id": "SOME_CORRELATION_ID",
  "error": "unsupported_grant_type",
  "error_codes": [
    70003
  ],
  "error_description": "
    ACS70003: The access grant 'authorization_code' is not supported.\r\n
    Trace ID: SOME_TRACE_UUID\r\n
    Correlation ID: SOME_CORRELATION_ID\r\n
    Timestamp: 2014-08-20 14:44:08Z",
  "timestamp": "2014-08-20 14:44:08Z",
  "trace_id": "SOME_TRACE_UUID"
}

(whitespace added for clarity)

This request does work if I change grant_type to client_credentials (but I have not found a way to use the resulting token for what I need). It also works if I change some URLs to point to Google instead of Azure AD.

Is there a mistake with these requests or does the service genuinely not support the documented grant_type of authorization_code?

Upvotes: 4

Views: 5835

Answers (2)

shiva
shiva

Reputation: 1

try this 

'grant_type':"client_credentials",
'resource': "your resource",
'client_id': "your client Id",
'redirect_uri': "your redirect URL",
'client_secret': "your client secret",

Upvotes: 0

Syed Mauze Rehan
Syed Mauze Rehan

Reputation: 1145

This is a bug I believe, and it took me 2-3 days to figure it out. Please do the following to get it working,

1) Remove the "?api-version=1.0" from your URL. I know it sounds strange but trust me their documentation is a mess.

2) Add a "Content-Type": "application/x-www-form-urlencoded" header in your request (hence you'll have to encode the post data values ... for example redirect_url=(encodedURL) etc

3) Remove unnecessary fields from post data REFER ... it should be like

{
    'grant_type': "authorization_code",
    'resource': "your resource",
    'client_id': "your client Id",
    'redirect_uri': "your redirect URL",
    'client_secret': "your client secret",
    'code': "the code u got"
}

I see you have done point 2 so you'll need to do point 1 and you're good to go.

Furthermore, if you want to get access_token quickly(if nothing I said works for you), then pass "client_credentials" in grant_type and you'll get a smaller response with access_token. But if you want the complete response with refresh_token as well, you'll have to do all those steps.

EDIT: There is one more mistake in their documentation, for Refresh Tokens >>> the URL should be oauth2/token and NOT oauth2/authorize

Hope this helps!

Upvotes: 4

Related Questions