search

AzureAD / microsoft-authentication-library-for-python

Microsoft Authentication Library (MSAL) for Python makes it easy to authenticate to Microsoft Entra ID. General docs are available here https://learn.microsoft.com/entra/msal/python/ Stable APIs are documented here https://msal-python.readthedocs.io. Questions can be asked on www.stackoverflow.com with tag "msal" + "python".
https://stackoverflow.com/questions/tagged/azure-ad-msal+python
Other
756 stars 191 forks source link

Error AADSTS700025 when deploying Flask authentication APP to IIS. #571

Closed AncestorComposition closed 9 months ago

AncestorComposition commented 1 year ago

Describe the bug Error AADSTS700025 when deploying Flask authentication APP to IIS.

To Reproduce Steps to reproduce the behavior:

  1. I followed the directions at https://learn.microsoft.com/en-us/azure/active-directory/develop/web-app-quickstart?pivots=devlang-python&tabs=windows and the authentication web app works when running on localhost.
  2. I then tried to deploy the authentication Flask app to IIS, but the user gets error message "AADSTS700025: Client is public so neither 'client_assertion' nor 'client_secret' should be presented."

Expected behavior User should be able to authenticate with the Flask app when the app is served via IIS. What you see instead "AADSTS700025: Client is public so neither 'client_assertion' nor 'client_secret' should be presented."

The MSAL Python version you are using 1.22.0

Additional context Add any other context about the problem here.

rayluo commented 1 year ago

What is your app's redirect uri when it is deployed to IIS? And, is that redirect uri be configured as a web platform in Azure Portal?

AncestorComposition commented 1 year ago

The redirect uri when it is deployed to IIS is https://dapp000639/greet/getAToken. I will have to check with our Azure Portal administrator to know the type of the URI. What are the options? What is the correct choice in this case?

AncestorComposition commented 1 year ago

I just checked and the type of the URI is "Single-page application".

rayluo commented 1 year ago

Per taxonomy, a Python-powered website is a Web application, not a SPA (single-page application).

You can try to change that redirect URI to Web (by delete and recreate?), or see if you can add a different URI whose type is Web, and see how that goes.

rayluo commented 9 months ago

As long as you do not use the same redirect URI for your app's different platforms (i.e. Web, Desktop, SPA, etc.), you shall be fine.