AADSTS7000218 - one of my application receives the following error when authenticates Entra id

Question

AADSTS7000218 - one of my application receives the following error when authenticates Entra id

Answer 1

Hi @James Stall

Is your app a confidential client app? If it is a confidential client app, then the 'client_assertion' or 'client_secret' parameter is necessary during authorization.

On the contrary, if it is a public client app, then the 'client_assertion' or 'client_secret' parameter is not required. However, you need to enable the public client flow for the app.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

Answer 2

@James Stall

Thank you for posting this in Microsoft Q&A.

As I understand you are getting below error message while trying to access the application configured in Entra ID.

Error: AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'.

Based off your error code - AADSTS7000218, I found some Stack Overflow threads and internal issues relating to your error message, and this could be due to the wrong App Registration default client type being used.

Client Credentials flow, Authorization Code flow, and On-Behalf-Of flow are used by Confidential client to request a token.  Azure AD will return the above error if the request is missing a client secret or a client assertion.

In order to resolve this, you'll need to:

1. Navigate to your Azure AD App Registration
2. Select Authentication
3. Change Allow public client flows to "Yes"

For more information on how public client and confidential client work- AADSTS7000218

• Confidential Client – A client who is capable of storing a secret (used to authenticate to Azure AD).  An example of this client is a web application, where its code and secret are stored on the server that’s not exposed to the public.  The application’s confidential information can only be accessed by an admin person.
• Public Client – A client not capable of storing any secret.  An example of a public client is a mobile application or a desktop application running at public kiosk in an insecure and unmanaged environment.

Reference:

• RECEIVING ERROR AADSTS7000218
• AADSTS error codes
• Public client and confidential client applications
• Desktop application authentication documentation
• Desktop app that calls web APIs: Acquire a token

Let me know if you have any further questions on this.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.