AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'. #552

fieeman · 2023-04-11T14:17:42Z

fieeman
Apr 11, 2023

Hi,

im will try to explain what i want to do

i want to download attachment from my outlook mailbox, but my organization has implementing 2FA, so im trying to get a token using the msal lib to use in the microsoft graph api.

so i made this code

app = PublicClientApplication(
    client_id=client_id,
    authority=authority,
)
result = None

accounts = app.get_accounts()
if accounts:
    result = app.acquire_token_silent(scopes, account=accounts[0])
else:
    flow = app.initiate_device_flow(scopes=scopes)
    print(flow['message'])

then i receive this message

To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code XXXXXXXX to authenticate.

to get a token im trying to do this

result = app.acquire_token_by_device_flow(flow)

if "access_token" in result:
    access_token = result['access_token']
    print(f'Access token: {access_token}')
else:
    print(result.get("error_description") or result.get("error"))

but i get this error

AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'.

I don't know where I should use these parameters.

if you have any suggestions it would be very helpful, thank you for your time.

Answered by rayluo

Apr 12, 2023

It is unfortunate that the error message was vague. You would need to toggle a setting in your app's registration (in Azure Portal) to enable Device Flow.

FWIW, if your app runs on your local desktop, then a better way is to add a Desktop app redirect URI with the value http://localhost into your app's registration, and then you can use MSAL's Desktop app sample from this "map". It works better than Device Flow.

View full answer

rayluo · 2023-04-12T00:43:40Z

rayluo
Apr 12, 2023
Maintainer

It is unfortunate that the error message was vague. You would need to toggle a setting in your app's registration (in Azure Portal) to enable Device Flow.

FWIW, if your app runs on your local desktop, then a better way is to add a Desktop app redirect URI with the value http://localhost into your app's registration, and then you can use MSAL's Desktop app sample from this "map". It works better than Device Flow.

0 replies

fieeman · 2023-04-14T13:49:03Z

fieeman
Apr 14, 2023
Author

thanks for your answer, using an application registered in the active directory works fine, but is there any way to get a token without registering an application in the active directory? like when I authenticate through the web?

0 replies

rayluo · 2023-04-14T18:38:31Z

rayluo
Apr 14, 2023
Maintainer

I hope you understand that most Q&A community (such as StackOverflow) would appreciate one question per discussion thread, so that the Q&A would be more searchable and beneficial for the future audience.

Since your original question has been answered, let's close this conversation here. Please ask your other generic questions on StackOverflow and the community would help. (You may also send your question link to my email, if your question gets no response within a reasonable time.)

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'. #552

Uh oh!

{{title}}

Uh oh!

Replies: 3 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'. #552

Uh oh!

fieeman Apr 11, 2023

Replies: 3 comments

Uh oh!

rayluo Apr 12, 2023 Maintainer

Uh oh!

fieeman Apr 14, 2023 Author

Uh oh!

rayluo Apr 14, 2023 Maintainer

fieeman
Apr 11, 2023

rayluo
Apr 12, 2023
Maintainer

fieeman
Apr 14, 2023
Author

rayluo
Apr 14, 2023
Maintainer