Azure CBA Authentication

Question

Hello,

Wondering if the bellow issue have been already addressed. I am having the same issue with error:

Message: AADSTS50192: Invalid request.

I tried all the workarounds I could find. The recommendation for browser caching doesn't fix the issue for me. Any help will be greatly appreciated.

Reference:

https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-certificate-based-authentication-technical-deep-dive

If CBA fails on a browser, even if the failure is because you cancel the certificate picker, you need to close the browser session and open a new session to try CBA again. A new session is required because browsers cache the certificate. When CBA is re-tried, the browser will send the cached certificate during the TLS challenge, which causes sign-in failure and the validation error.

Click More details to get logging information that can be sent to an administrator, who in turn can get more information from the Sign-in logs.

Click Other ways to sign in to try other methods available to the user to sign in.

Note

If you retry CBA in a browser, it'll keep failing due to the browser caching issue. Users need to open a new browser session and sign in again.

If CBA fails on a browser, even if the failure is because you cancel the certificate picker, you need to close the browser session and open a new session to try CBA again. A new session is required because browsers cache the certificate. When CBA is re-tried, the browser will send the cached certificate during the TLS challenge, which causes sign-in failure and the validation error.

Click More details to get logging information that can be sent to an administrator, who in turn can get more information from the Sign-in logs.

Click Other ways to sign in to try other methods available to the user to sign in.

 Note

If you retry CBA in a browser, it'll keep failing due to the browser caching issue. Users need to open a new browser session and sign in again.

Answer 1

• @Marilee Turscak-MSFT - I am not sure whether the question is for me. I'll try to answer this way: I am trying to set up CBA for Client Authentication. I followed the steps as directed on this link: https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-certificate-based-authentication#step-4-enable-cba-on-the-tenant

I have not been successful thus far. I am wondering if I am missing anything. Below is the error message & my screenshot:

Message: AADSTS50000: There was an error issuing a token or an issue with our sign-in service.