Exception: 400 Bad Request

[ssamueluk]

Hi,

I've downloaded the latest version of Oauth Sample and followed the setup steps.
I get a callback with the authorization code okay, but the call to get the token from the code always fails with a webexception: "The remote server returned an error: (400) Bad Request."

Here is the request to get the token which is failing(the token and app name below are fake):

client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&client_assertion=ey0......iOiJSUI1NiIs&grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=eyJ0...........XG-MLE9_w&redirect_uri=https://myapp-staging.azurewebsites.net/oauth/callback

and the Content-Type used is application/x-www-form-urlencoded as instructed.

Please advise.

Thanks,
SS

[githubLewis]

Have you managed to resolve this issue? I've downloaded the latest source, followed the instructions to the letter and I get a 400 bad request "invalid client auth token." error.

Anyone found the solution?

---

Update - my problem was that somehow I had swapped the Auth url & Token url (suspect Copy\Paste error). Once I'd corrected it the code worked fine straight "out the box". I did have to modify the code to dump the full error details (Exception & the message returned) to the partial view "TokenView" to help debug the issue.

[peakyy]

Hi,

We are currently investigating a fix here and will get back to the thread when we have figured out the issue.

        Peaky

[philipstratford]

I'm having the exact same issue as @ssamueluk. I suspected that I might have confused auth and token URLs like @githubLewis, but I've double (triple) checked and I seem to have them the right way around.

Update
Predictably, the problem was a mistake of my own - I was passing the App Secret rather than the Client Secret with the request for the token.

[frandi]

Yep, I can confirm too that it is the Client Secret that is needed in the request token post data, not the App Secret.

[ssamueluk]

Thanks philipstratford and frandi. I confirm that my application works fine when using client secret instead of the app secret. Closing the issue.