Getting MsalClientException while requesting token from EWS.AccessAsUser.All using delegate permission

userbZHk 0
Viewed 73

I have followed all the step mentioned in this answer given by @Robert Muehsig and added the code in .net framework console app after running I am getting below error,

Microsoft.Identity.Client.MsalClientException: 'There was an error parsing WS-Trust response from the endpoint. This may occur if there is an issue with your ADFS configuration. See https://aka.ms/msal-net-iwa-troubleshooting for more details. Error Message: returned error: ID3242: The security token could not be authenticated or authorized. '

code part

var pcaOptions = new PublicClientApplicationOptions
            {
                ClientId = "ClientId",
                TenantId = "TenantId"
            };

            var pca = PublicClientApplicationBuilder.CreateWithApplicationOptions(pcaOptions).Build();

            var securePassword = new SecureString();
            foreach (char c in "Password")
                securePassword.AppendChar(c);

            var cred = new NetworkCredential("Username", securePassword);

            var authResult = await pca.AcquireTokenByUsernamePassword(new string[] { "https://outlook.office.com/EWS.AccessAsUser.All" }, cred.UserName, cred.SecurePassword).ExecuteAsync();

During registration I have set "Treat application as public client" true.

From postman I able to get token but if add it during debug point it will throw 401 error.

oauth oauth-2.0 azure-active-directory c#
1 Answers
  • It looks like either the username or password passed in the credentials are incorrect.
  • Also use current or latest version of dot net to clear the issues regarding compatibility
  • As you are getting token, after decoding it check the audience is valid, and see if it is either clientId or appId uri. If not try to change the accessTokenAcceptedVersion to 2 if it is null or to 1 or null if it is 2.

enter image description here

And make sure the scope https://outlook.office.com/EWS.AccessAsUser.All that is given in code is also given in azure ad portal and granted admin consent from admin and users if set to consent by them .

kavya Saraboju0
Related