How to generate access_token for grant_type password in Azure AD for MS graph api

user_14004008 0
Viewed 4601

I have use followed these two links to generate access_token password grant_type

  1. https://dzone.com/articles/getting-access-token-for-microsoft-graph-using-oau-2?preview=true
  2. https://docs.microsoft.com/en-us/azure/active-directory-b2c/configure-ropc?tabs=app-reg-ga

I used below curl request

curl --location --request POST 'https://login.microsoftonline.com/910f-90d18b56a170/oauth2/token' --header 'Content-Type: application/x-www-form-urlencoded' --data-urlencode 'client_id=4b5d-bde6-0b1a09b84a5f' --data-urlencode 'client_secret=q4720z4z_6N8CU-c7qEwx2a' --data-urlencode 'grant_type=password' --data-urlencode 'username=xxxx@yyyy.onmicrosoft.com' --data-urlencode 'password=xxxxxxx' --data-urlencode 'resource=https://graph.microsoft.com' --data-urlencode 'scope=openid'

Below is the response

{
    "error": "invalid_grant",
    "error_description": "AADSTS50126: Error validating credentials due to invalid username or password.\r\nTrace ID: 21fdd138-0bc6-49bd-8852-c7a6a3a1e600\r\nCorrelation ID: a1010714-38f6-4926-a135-568adcdada26\r\nTimestamp: 2020-12-15 16:44:37Z",
    "error_codes": [
        50126
    ],
    "timestamp": "2020-12-15 16:44:37Z",
    "trace_id": "21fdd138-0bc6-49bd-8852-c7a6a3a1e600",
    "correlation_id": "a1010714-38f6-4926-a135-568adcdada26",
    "error_uri": "https://login.microsoftonline.com/error?code=50126"
}

I don't know why response suggests that my credentials are in-valid even-though I'm passing right creds.

microsoft-graph-api azure-active-directory azure
2 Answers

Facing the same issue when I run the below query with wrong credentials enter image description here

After providing the right credentials to below curl operations able to get token

  curl -X POST -d "client_id=clientid&scope=user.read&grant_type=password&username=username &password=password&resource=https://graph.microsoft.com " https://login.microsoftonline.com/tenantid/oauth2/token

enter image description here

enter image description here

Note :Microsoft recommends you do not use the ROPC flow. In most scenarios, more secure alternatives are available and recommended. This flow requires a very high degree of trust in the application, and carries risks which are not present in other flows. You should only use this flow when other more secure flows can't be used.

user_129767040

Yes i was able to resolve this error with below curl request. Also had to use utf character code for special symbols in my password from this link "https://www.utf8-chartable.de/" while running the command from linux terminal, though it wasn't required for getting token via Postman

curl -X POST -d "client_id=3621485b0bf-6384-4b5d-bde6-0b1a09b84a5f&client_secret=145236op-54782314l-c7qEwx2a-U_T_-7-43n&scope=user.read&grant_type=password&username=johndoe@yyyy.onmicrosoft.com&password=Prince%244321&resource=https://graph.microsoft.com" https://login.microsoftonline.com/7452369-45217-4208-910f-90d18b56a170/oauth2/token

 # below is the Response
{
    "token_type": "Bearer",
    "scope": "ChannelMessage.Send Group.Read.All Group.ReadWrite.All Mail.Read offline_access openid profile User.Read",
    "expires_in": "3599",
    "ext_expires_in": "3599",
    "expires_on": "1608079489",
    "not_before": "1608075589",
    "resource": "https://graph.microsoft.com",
    "access_token": "eyJ0eXAiOiJKV1QiLCJub25jZSI6Ijl3NVBGbUpfQ1NsNjhhVHJ6dFJjVXZ0c1NaWm5nckFLS3JoQmFSbY2ZTgtNDUzMC04NzhhLTg4MjBmNDJlZjQ3NiIsInBsYXRmIjoiMTQiLCJwdWlkIjoiMTAwMzIwMDEwM0M4MkJDNSIsInJoIjoiMC5BQUFBSWZocjZPcldFRVdQLTN4b2JHUlg4aHBadjJQSDRmVkpoNlBMc2RFSGF6dFRBRG8uIiwic2NwIjoiQ2hhbm5lbE1lc3NhZ2UuU2VuZCBHcm91cC5SZWFkLkFsbCBHcm91cC5SZWFkV3Jp-OlzPDtk0GTG9o5AGLcTVv6VEVOFWF2TEylgdXnTX5A4Iue7Le8OcUtFa33of_11uvZuhEcxTzY_ANEz-R5TFhZJlxeeyw",
    "refresh_token": "0.AAAAIfhr6OrWEEWP-3xobGRX8hpZv2PH4fVJh6PLsdEHaztTADo.GSfVElYY1X0hIwKK3JBkMHTamjwx9uEDeV9U8nPbEBe7w64JdaexMVJMyBeNFZOOrAda7wDGCUJq_1gv9J0k3X3QYsJafyOeuDtDckks9tLzHbD4ZJWAxN0Dnw-OaO4Tq95sa7-wozkCwC5ZWfTdeDjp6qb92SEKtQSl8YUCe340f1y_DuL6C2yMQARfgSPCTuuVz2TqMm8MjM46m4_WSz7ATK_UfzcHyywsBVYpxfgOzAA2eShbCqjMZbvab0moyvmo",
    "id_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJhdWQiOiI2M2JmNTkxYS1lMWM3LTQ5ZjUtODdhMy1jYmIxZDEwNzZiM2IiLCJpc3MiOiJodHRwczovLuMCJ9."
}

To achieve my desired results, i had to create a new user in Azure-AD and use those creds.

For someodd reason my creds for admin/main user for Azure-Portal were throwing this error "Error validating credentials due to invalid username or password" eventhough that user exists in users list.

user_140040080
Related