Microsoft identity platform and OAuth 2.0 authorization code flow (PKCE) - Error "AADSTS700025"

Question

Trying to get access token by following the microsoft instructions.But I get an error, for that there is no answer with a solution. What am I doing wrong, what this mean in my situation? enter image description here Requests: https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize *auth_code : client_id & response_type & redirect_uri & response_mode & scope & code_challenge & code_challenge_method.

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token *get access token: client_id & scope & code & redirect_uri & grant_type & code_verifier & client_secret.(Content-Type: application/x-www-form-urlencoded) redirect_uri == are the same in both cases.

In the first request it is possible to get auth_code, but when i trying to get access token with this auth_code then I get : Error "AADSTS700025" Client is public so neither 'client_assertion' nor 'client_secret' should be presented. But I use client_secret NOT client_assertion_type & client_assertion. Followed the microsoft instructions...

Answer 1

I'm guessing that this is a 'SPA' type 'Platform' (as added within your 'AAD'/Azure AD 'app-registration'), or one of the other 'Public clients'?

It's likely telling you that the server does not want to deal with/trust a public client that is dealing with/privy to (potentially/more-likely susceptible) secrets (- such as 'client_secret' & 'client_assertion' values).

E.g. If this was a 'Private/Confidential Client', you could add (& configure) the 'Web' type 'Platform' - because it is trusted to handle secrets, and (in theory) the error would no longer occur.

Answer 2

Reproduce the same kind of issue as you are facing (As i am using AuthCode to generate Access Token)

Solution--

Aussming you are using grant_type is client_credentials to get the access token using below API:

https://login.microsoftonline.com/{tenantid}/oauth2/v2.0/token

To get the access token you don't require the AuthCode you can get it by client credentails only. Please do the configuration as i did below picture in my Body.