Add confidential client troubleshooting guide#760
Conversation
New page covering common issues in confidential client apps: - Throttling (HTTP 429 / AADSTS50196) - Network instability and socket exceptions - On-Behalf-Of (OBO) failures - Client credential errors (invalid secret, expired cert, app not found) - Token cache miss diagnosis - Managed Identity failures Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Learn Build status updates of commit b9d6304: ✅ Validation status: passed
For more details, please refer to the build report. |
PoliCheck Scan ReportThe following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans. ✅ No issues foundMore information about PoliCheckInformation: PoliCheck | Severity Guidance | Term |
|
|
||
| Verify if there are any recent updates to network or firewall rules that might have caused connectivity issues to `login.microsoftonline.com` and regional endpoints. | ||
|
|
||
| ## On-Behalf-Of (OBO) failures |
There was a problem hiding this comment.
there are also cases where a UiRequiredException is thrown and the user needs to handle conditional access by satisfying the provided access policies in the claims.
trwalke
left a comment
trwalke
left a comment
There was a problem hiding this comment.
Should handle claims challenge for conditional access. otherwise LGTM
|
|
||
| `MsalServiceException` with `AADSTS7000215: Invalid client secret provided`. | ||
|
|
||
| #### Resolution |
There was a problem hiding this comment.
My understanding is that we wanted to move away from client secrets due to security. Should probable add a comment here encouraging customers to use certs or some other auth method.
|
|
||
| #### Symptoms | ||
|
|
||
| `MsalServiceException` with error code `AADSTS50013: Assertion failed signature validation` or `invalid_grant`. |
There was a problem hiding this comment.
I think it's worth stating that apps should not try to extract the AADSTS error codes and to handle these dynamically. The codes are just references.
The exception types are sufficient for dynamic processing, e.g. UiRequiredException - need to reprompt the user, ClaimsExcepton - need to add claims.
3 participants
Summary
Adds a new troubleshooting page for confidential client applications under Advanced > Handling exceptions and errors.
Topics covered
Motivation
These scenarios were identified as gaps in the existing MSAL.NET documentation. The current exception/error handling docs focus primarily on public client (desktop/mobile) flows. This page provides equivalent guidance for service-to-service scenarios that are common in production workloads.
Changes