Partilhar via


Authorization Endpoint Errors

 

This topic explains how to interpret and respond to errors that originate at the Azure AD authorization endpoint.

Errors that occurs at the Azure authorization endpoint are returned in two different ways. When the error is displayed on a web page, it uses an HTTP 200 status code. When a client application is available to handle the error, the endpoint uses an HTTP 302 redirect status code.

Here is a sample HTTP 302 error response from the Azure AD authorization when an authorization code request is missing the required response_type parameter.

GET  HTTP/1.1 302 Found
Location: https://localhost/myapp/?error=invalid_request&error_description=AADSTS90014%3a+The+request+body+must+contain+the+following+parameter%3a+%27response_type%27.%0d%0aTrace+ID%3a+57f5cb47-2278-4802-a018-d05d9145daad%0d%0aCorrelation+ID%3a+570a9ed3-bf1d-40d1-81ae-63465cc25488%0d%0aTimestamp%3a+2013-12-31+05%3a51%3a35Z&state=D79E5777-702E-4260-9A62-37F75FF22CCE

Error Response Parameters

Client-handled error responses includes the following parameters.

Parameter

Description

error

An error code value defined in Section 5.2 of the OAuth 2.0 Authorization Framework. The next table describes the error codes that Azure AD returns.

error_description

A more detailed description of the error. This message is not intended to be end-user friendly.

state

Returns the state value from the request, if the request includes a state value.

The state value is a randomly generated non-reused value that is sent in the request and returned in the response to prevent cross-site request forgery (CSRF) attacks. For more information, see Best Practices for OAuth 2.0 in Azure AD.

Error Codes

The following table describes the error codes (error parameter values) that the Azure AD authorization endpoint returns.

Error code

Description

Client Action

invalid_request

Protocol error, such as a missing required parameter.

Fix and resubmit the request. For reference, use the protocol documentation and Authorization Code Grant Flow. This is a development error is typically caught during initial testing.

unauthorized_client

The client application is not permitted to request an authorization code.

This usually occurs when the client application is not registered in Azure AD or is not added to the user's Azure AD tenant. The application can prompt the user with instruction for installing the application and adding it to Azure AD. For more information, see Application Access.

access_denied

Resource owner denied consent

The client application can notify the user that it cannot proceed unless the user consents.

unsupported_response_type

The authorization server does not support the response type in the request.

Fix and resubmit the request. For reference, use the protocol documentation and Authorization Code Grant Flow. This is a development error is typically caught during initial testing.

server_error

The server encountered an unexpected error.

Retry the request. These errors can result from temporary conditions. The client application might explain to the user that its response is delayed due a temporary error.

temporarily_unavailable

The server is temporarily too busy to handle the request.

Retry the request. The client application might explain to the user that its response is delayed due a temporary condition.

invalid_resource

The target resource is invalid because it does not exist, Azure AD cannot find it, or it is not correctly configured.

This indicates the resource has not been configured in the tenant. The application can prompt the user with instruction for installing the application and adding it to Azure AD. For more information, see Application Access.

See Also

Error Handling in OAuth 2.0
OAuth 2.0 in Azure AD
Token Issuance Endpoint Errors
Errors from Secured Resources
Best Practices for OAuth 2.0 in Azure AD