oAuth with Azure Active Directory fails due to [AADSTS50012: Invalid client secret is provided]

1
votes

I'm implementing a webapp that connects to Dynamics365 via webapi. Therefore I'm using Azure Active Directory for oAuth. I'm getting the following error and I'm not sure where is something going wrong. Therefore I'm describing my whole procedure:

"error":"invalid_client",
"error_description":"AADSTS70002: Error validating credentials. AADSTS50012: Invalid client secret is provided.
      Trace ID: 2cc92fcd-798b-4636-892d-0c3c397c0401
      Correlation ID: f3bd2f4c-05c5-4de8-ace2-acf4b99e6fb9
      Timestamp: 2018-09-19 09:43:38Z",
"error_codes":[70002,50012],
"timestamp":"2018-09-19 09:43:38Z",
"trace_id":"2cc92fcd-798b-4636-892d-0c3c397c0401",
"correlation_id":"f3bd2f4c-05c5-4de8-ace2-acf4b99e6fb9"

I'm using these urls including the tenant. I got got them from the Azure Portal / Azure Active Directory / App Registration:

I registered a new app in the App Registration. I used the app ID and created a key that I used as client_secret. Calling the authorize-url is working fine! Then it is redirected to my callback.

Then I'm getting a code that I try to use to get a token. But it returns the error mentioned above. Input for POST-request to /oauth2/token is the following:

grant_type=authorization_code&
client_id={same as for authorize}&
code={returned code from authorize}&
redirect_uri={the callback of my webapp}&
resource={also callback-url}&
client_secret={the key from the keys-section in App Registration}

I'm looking forward to any ideas!

1
oauth-2.0azure-active-directorydynamics-365
The error already prompts your secret is invalid, so you need to check your key whether the key already expires. If expired, you need to create a new key. - SunnySun
I created a new client-secret which expires in 1 year. - xforfun
If this, maybe the client-secret contains special characters like , / ? : @ & = + $ #, you could use encodeurl to encode your secret and then try agian. - SunnySun

1 Answers

2
votes

A few things you can try:

  1. As Sunny suggested in the comments, a simple step would be to create a new key in the app registration and try that one.
  2. Make sure that you have the Client Secret in your config or app settings matches exactly what you have in the portal. Also make sure that you don't somehow have duplicate app settings that could be overwriting each other.

  3. From this similar discussion on MSDN:

    1. Go to https://identity.microsoft.com login, and then select your app.

    2. Click on "Generate New Password"

    3. Use that value as the client_secret parameter.