[Help] I am using the method AcquireTokenByUsernamePassword to get the token, but I get the following error. I haven't configured it properly. thank you

[kou-h]

I am using the method AcquireTokenByUsernamePassword to get the token, but I get the following error. I haven't configured it properly. thank you

Microsoft.Identity.Client：Version="4.49.1"

code：
public readonly static string[] ApiScopes = { "openid", "profile", "offline_access", "User.ManageIdentities.All", "User.Read.All","User.ReadBasic.All","User.Invite.All","User.ReadWrite.All","IdentityProvider.Read.All" };

app = PublicClientApplicationBuilder.Create(ClientId)
.WithB2CAuthority(AuthoritySignUpSignIn)
.WithRedirectUri("http://localhost:8080/home")
.WithExtraQueryParameters(new Dictionary<string, string>() { { "nonce", Guid.NewGuid().ToString() } })
.WithLogging(Log, LogLevel.Info, false)
.Build();

authResult = await app.AcquireTokenByUsernamePassword(App.ApiScopes, "UserName", "UserPassword").ExecuteAsync();

Error Message：
Error Acquiring Token:
Microsoft.Identity.Json.JsonReaderException: Unexpected character encountered while parsing value: <. Path '', line 0, position 0.
at Microsoft.Identity.Json.JsonTextReader.ParseValue()
at Microsoft.Identity.Json.JsonReader.ReadForType(JsonContract contract, Boolean hasConverter)
at Microsoft.Identity.Json.Serialization.JsonSerializerInternalReader.Deserialize(JsonReader reader, Type objectType, Boolean checkAdditionalContent)
at Microsoft.Identity.Json.JsonSerializer.DeserializeInternal(JsonReader reader, Type objectType)
at Microsoft.Identity.Json.JsonConvert.DeserializeObject(String value, Type type, JsonSerializerSettings settings)
at Microsoft.Identity.Json.JsonConvert.DeserializeObject[T](String value, JsonSerializerSettings settings)
at Microsoft.Identity.Client.Utils.JsonHelper.DeserializeFromJson[T](String json)
at Microsoft.Identity.Client.OAuth2.OAuth2Client.CreateResponse[T](HttpResponse response, RequestContext requestContext)
at Microsoft.Identity.Client.OAuth2.OAuth2Client.ExecuteRequestAsync[T](Uri endPoint, HttpMethod method, RequestContext requestContext, Boolean expectErrorsOn200OK, Boolean addCommonHeaders, Func2 onBeforePostRequestData) at Microsoft.Identity.Client.OAuth2.OAuth2Client.GetTokenAsync(Uri endPoint, RequestContext requestContext, Boolean addCommonHeaders, Func2 onBeforePostRequestHandler)
at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger)
at Microsoft.Identity.Client.OAuth2.TokenClient.SendTokenRequestAsync(IDictionary`2 additionalBodyParameters, String scopeOverride, String tokenEndpointOverride, CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.UsernamePasswordRequest.GetTokenResponseAsync(CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.UsernamePasswordRequest.ExecuteAsync(CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
at Microsoft.Identity.Client.ApiConfig.Executors.PublicClientExecutor.ExecuteAsync(AcquireTokenCommonParameters commonParameters, AcquireTokenByUsernamePasswordParameters usernamePasswordParameters, CancellationToken cancellationToken)

[pmaytak]

@kou-h
This parsing issue sometimes happens when the application is not set up correctly in Azure; and Azure AD returns an unusual error response.

Verify that this B2C app is correctly set up in Azure portal. See this wiki and this wiki. You may have to create a new flow (other than SignUpSignIn) for Username/Password. Also note the limitations and potential error causes - password is wrong or expired, non-local B2C account is used.

Also our usual disclaimer - Username/Password flow is not recommended because it's not secure.

[bgavrilMS]

Still, one can argue that MSAL should throw a friendlier exception and not a JSON parsing error. I would recommend treating this as a bug.

@kou-h - a few thoughts:

1. You can't ask for Graph scopes with a B2C user. Graph only works with Azure AD authority
2. Username / Password is insecure because apps should not handle passwowrds. But apart from that, the flow will not work with MFA. So please use AcquireTokenInteractive instead.
3. Can you capture a network trace and send it over? Use bogavril at microsoft.com

[SameerK-MSFT]

@kou-h what version of .net are you using?

[kou-h]

@SameerK-MSFT
Is it the version of. net core? If yes, I use. net core 6.0

[bgavrilMS]

@SameerK-MSFT - not sure why this matters? It's just about throwing a better exception if folks attempt ROPC with B2C authority and graph scope.