Skip to content

AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'. #551

Closed
Closed
AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'.#551
Labels
question

Description

@fieeman
Paul Kevin Rengifo Sandoval (fieeman)
opened on Apr 11, 2023

Hi,

im will try to explain what i want to do

i want to download attachment from my outlook mailbox, but my organization has implementing 2FA, so im trying to get a token using the msal lib to use in the microsoft graph api.

so i made this code

app = PublicClientApplication(
    client_id=client_id,
    authority=authority,
)
result = None

accounts = app.get_accounts()
if accounts:
    result = app.acquire_token_silent(scopes, account=accounts[0])
else:
    flow = app.initiate_device_flow(scopes=scopes)
    print(flow['message'])

then i receive this message

To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code XXXXXXXX to authenticate.

to get a token im trying to do this

result = app.acquire_token_by_device_flow(flow)

if "access_token" in result:
    access_token = result['access_token']
    print(f'Access token: {access_token}')
else:
    print(result.get("error_description") or result.get("error"))

but i get this error

AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'.

I don't know where I should use these parameters.

if you have any suggestions it would be very helpful, thank you for your time.

Activity

  1. Ray Luo (rayluo)
    added
    question
    on Apr 12, 2023

  2. rayluo commented on Apr 12, 2023

    @rayluo
    Ray Luo (rayluo)
    on Apr 12, 2023
    Contributor

    It is unfortunate that the error message was vague. You would need to toggle a setting in your app's registration (in Azure Portal) to enable Device Flow.

    FWIW, if your app runs on your local desktop, then a better way is to add a Desktop app redirect URI with the value http://localhost into your app's registration, and then you can use MSAL's Desktop app sample from this "map". It works better than Device Flow.

  3. fieeman commented on Apr 14, 2023

    @fieeman
    Paul Kevin Rengifo Sandoval (fieeman)
    on Apr 14, 2023
    Author

    thanks for your answer, using an application registered in the active directory works fine, but is there any way to get a token without registering an application in the active directory? like when I authenticate through the web?

  4. rayluo commented on Apr 14, 2023

    @rayluo
    Ray Luo (rayluo)
    on Apr 14, 2023
    Contributor

    I hope you understand that most Q&A community (such as StackOverflow) would appreciate one question per discussion thread, so that the Q&A would be more searchable and beneficial for the future audience.

    Since your original question has been answered, let's close this conversation here. Please ask your other generic questions on StackOverflow and the community would help. (You may also send your question link to my email, if your question gets no response within a reasonable time.)

  5. Ray Luo (rayluo)
    closed this as completedon Apr 14, 2023
  6. AzureAD
    locked and limited conversation to collaborators on Apr 14, 2023
  7. Ray Luo (rayluo)
    converted this issue into a discussion #552 on Apr 14, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    question

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions