The request body must contain the following parameter: 'client_assertion' or 'client_secret

user_14274793 0
Viewed 8165

For user authentication, I am using the latest @azure/msal-angular package. This angular library is based on the latest MSAL library for AD authentication. But library throws an error given below:

ServerError: invalid_client: 7000218 - [2021-05-14 07:42:54Z]: AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'.

"@angular/core": "~10.2.4",
"@azure/msal-angular": "^2.0.0",
"@azure/msal-browser": "^2.14.1"

Configuration in app module.

{
    auth: {
      authority: 'https://login.microsoftonline.com/<tenant>/',
      clientId: 'my client id',
      redirectUri: 'http://localhost:4200',
      postLogoutRedirectUri: 'http://localhost:4200/',
      navigateToLoginRequestUrl: false
    },
    cache:{
      cacheLocation: BrowserCacheLocation.LocalStorage
    },
    system: {
      loggerOptions: {
        loggerCallback,
        logLevel: LogLevel.Info,
        piiLoggingEnabled: false
      }
    }
  }

Getting this error when executing below code in OnInit (app component)

this.msalService.instance.handleRedirectPromise().then(response => {
      console.log('response', response);
      if (response !== null && response.account !== null) {
        this.msalService.instance.setActiveAccount(response.account);
      }
    });

Some blogs says like, to change the app type to public type. Is there any other option to resolve this issue?

msal azure-active-directory angular
1 Answers

Your error should be this:

enter image description here

The reason for this error is that you are sending a silent request, but you have not logged in to the user first. There are two ways to solve this problem:

    1. Send a login request before requesting the token.
    1. Use Implicit grant and hybrid flows to execute the dynamic login request directly in the browser, and you can directly obtain the id token and access token in the browser.
https://login.microsoftonline.com/{tenant id}/oauth2/v2.0/authorize?
client_id={client_id}
&response_type=id_token token
&redirect_uri={redirect_uri}
&scope=openid {api resource scope}
&response_mode=fragment
&state=12345
&nonce=678910
user_133366830
Related