Geek Answers Handbook

"Access authorization for access to access is not supported" from Azure AD using Oauth 2

I am in the middle of a grant stream for authorization code with Azure AD. Despite the fact that the documentation states what grant_typeshould be authorization_code, I get an error message about this property.

POST https://login.windows.net/SOME_AZURE_AD_UUID/oauth2/token?api-version=1.0
Content-Type: application/x-www-form-urlencoded

client_id=SECRET_CLIENT_ID
&client_secret=SECRET_CLIENT_SECRET
&code=SECRET_CODE
&grant_type=authorization_code
&redirect_uri=https://myserver.example.com/login/auth_return
&resource=https://myserver.example.com/
&scope=openid email

( edit : added spaces for clarity)

The error I am returning is:

HTTP/1.1 400 Bad request
Content-Length: 436
X-Content-Type-Options: nosniff
X-Powered-By: ASP.NET
Request-Id: SOME_REQUEST_ID
X-Ms-Request-Id: SOME_REQUEST_ID
Strict-Transport-Security: max-age=31536000; includeSubDomains
Set-Cookie: x-ms-gateway-slice=slicea; path=/; secure; HttpOnly, stsservicecookie=acs; path=/; secure; HttpOnly
Server: Microsoft-IIS/8.0
Cache-Control: private
Date: Wed, 20 Aug 2014 14:44:08 GMT
Content-Type: application/json; charset=utf-8

{
  "correlation_id": "SOME_CORRELATION_ID",
  "error": "unsupported_grant_type",
  "error_codes": [
    70003
  ],
  "error_description": "
    ACS70003: The access grant 'authorization_code' is not supported.\r\n
    Trace ID: SOME_TRACE_UUID\r\n
    Correlation ID: SOME_CORRELATION_ID\r\n
    Timestamp: 2014-08-20 14:44:08Z",
  "timestamp": "2014-08-20 14:44:08Z",
  "trace_id": "SOME_TRACE_UUID"
}

(spaces added for clarity)

This request works if I change grant_typeto client_credentials(but I have not found a way to use the received token for what I need). It also works if I change some URLs to point to Google instead of Azure AD.

grant_type of authorization_code?

+4
1

, , 2-3 , . , , ,

1) URL URL- "api-version = 1.0". , , , - .

2) "Content-Type": "application/x-www-form-urlencoded" (, post... redirect_url = (encodedURL) ..

3) REFER...

{
    'grant_type': "authorization_code",
    'resource': "your resource",
    'client_id': "your client Id",
    'redirect_uri': "your redirect URL",
    'client_secret': "your client secret",
    'code': "the code u got"
}

, 2, 1, .

, access_token ( , "client_credentials" grant_type, access_token. refresh_token, .

: , → > URL oauth2/token NOT oauth2/authorize

, !

+4

More articles:


All Articles