CODEWITHSUNDEEP
azureazure-active-directoryazure-ad-graph-apiazure-ad-msalazure-authentication
Saalim Aslam
Saalim Aslam

Reputation: 111

MSAL - Problem acquiring token with IntegratedWindowsAuth

I am using MSAL to acquire token from an auth app in Azure using integrated windows authentication. The code is:

var tenant = $"https://login.microsoftonline.com/<myTenantId>";
var clientId = "<myClientId>";
var scopes =  new string[] { "https://graph.microsoft.com/.default" };

var publicApplication = PublicClientApplicationBuilder.Create(clientId).WithAuthority(tenant).Build();
var token = await publicApplication.AcquireTokenByIntegratedWindowsAuth(scopes).ExecuteAsync();

This throws the following exception:

Integrated Windows Auth is not supported for managed users.

I have followed the steps from https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/wiki/Integrated-Windows-Authentication and as far as I can confirm I have not missed anything.

Is there something that I might have missed in my configuration? Any help in this is highly appreciated.

Upvotes: 5

Views: 9600

Answers (2)

Saalim Aslam
Saalim Aslam

Reputation: 111

From my discussion with Microsoft, IWA is not supported for pass-through authentication (which was the scenario in my case). For IWA to work, we need to have ADFS in our environment.

Upvotes: 2

Joey Cai
Joey Cai

Reputation: 20067

IWA only support Federated users, those created in an Active Directory and backed by Azure Active Directory.

Try to check if your users are recognized as federated instead of managed.

And refer to this code sample.

Upvotes: 0

Related Questions