invalid_grant", "error_description": "AADSTS50126: Error validating credentials due to invalid username or password.\r\nTrace

Question

Hi @AmanpreetSingh-MSFT ,@MarileeTurscak
I am calling Https://login.microsoftonline.com/<myTenantId>/oauth2/token url for refresh token . but i am getting below error

"error": "invalid_grant",
"error_description": "AADSTS50126: Error validating credentials due to invalid username or password.\r\nTrace ID: dbf5175a-6d99-49db-8dfb-c7be1f9a1700\r\nCorrelation ID: d279d8ec-577f-4a5c-b1b0-2a68d4e0e68b\r\nTimestamp: 2021-05-18 11:19:07Z",
"error_codes": [
50126
],
"timestamp": "2021-05-18 11:19:07Z",
"trace_id": "dbf5175a-6d99-49db-8dfb-c7be1f9a1700",
"correlation_id": "d279d8ec-577f-4a5c-b1b0-2a68d4e0e68b",
"error_uri": "https://login.microsoftonline.com/error?code=50126"
}
I have reseted the password also but did not work. i am trying to resolve this issue since last 2 month

Please help me on this

Answer 1

Hi @Kumar, Rajeev (CWF) · Thank you for reaching out.

By tracking the Correlation and Request ID, I found that the account you are using is a federated account, which requires redirection to ADFS for authentication. The ROPC (password) flow doesn't support this redirection and tries to authenticate the user directly in Azure AD. Hence, the error AADSTS50126: Error validating credentials due to invalid username or password. is thrown.

To resolve the issue, you can choose to go with one of the below options:

1. Create a cloud only user account, reset the temporary password and use that account.
2. If creating cloud-only user is not an option for you, follow the instructions I have provided in This Blog Post. If you choose to go with this option and don't want to sync password hash for all accounts, use Selective password hash synchronization

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Thank you so much @AmanpreetSingh-MSFT

I am using a cloud only user account. Now I'm able to obtain an authorization token with this new cloud only service account

Thanks your quick help.