OAuth 2.0 login from an application

Question

I am getting this error trying to set up OAuth 2.0 login from an application. Error Code: 50126 Message: Error validating credentials due to invalid username or password. Username and password are definitely correct. Azure App registration is set up and correct company ID and Secret are being used. I can get a cloud only account to work which seems to validate my App Registration, but an AD account synched to O365 using Okta will not work. Cloud account - ******@tennant.onmicrosoft.com works. Domain account - testemail@keyman .com does NOT work

Answer 1

Hi @Tom Flanagan ,

I understand that you are receiving the AADSTS50126 error even though the correct password is entered.

If the account is using federated authentication, this error is also expected. This is because if you have Federated authentication enabled for user sign-in, you get redirected to the federated IDP for credential validation. When you are using the ROPC flow via postman, this redirection is not possible and it results in the "Invalid username or password" error.

Note that federated authentication does not just mean that you are using ADFS. You can use 3rd party IDPs such as Auth0, OneLogin, and others. You will know that you are using federated authentication if you see the below image while signing in via browser with the same account:

Alternatively, to make this scenario working with Federated accounts,

1. Sync users' passwords to Azure AD. If you don't want to sync password for entire organization, you may consider using Selective Password Hash Sync.
2. Create a policy to allow credentials validation of federated users from within Azure AD.
3. Link the policy to the application, for which you want to use ROPC flow with federated accounts.

Please refer to these threads -
https://learn.microsoft.com/en-us/answers/questions/385629/index.html
https://learn.microsoft.com/en-us/answers/questions/38035/index.html

Hope this helps.
If the answer is helpful, please click Accept Answer and kindly upvote. If you have any further questions about this answer, please click Comment.