Get error: “Password is required for managed user” when authenticating user with ADAL Library
Try to run the project of active-directory-dotnet-native-headless, it works when acquiring token with username password. But failed and throw exception when acquiring token with Windows Integrated auth(WIA) as below:
//UserCredential uc = TextualPrompt();
// if you want to use Windows integrated auth, comment the line above and uncomment the one below
UserCredential uc = new UserCredential();
try
{
result = authContext.AcquireTokenAsync(todoListResourceId, clientId, uc).Result;
}
catch (Exception ee)
{
ShowError(ee);
return;
}
The error is:
An unexpected error occurred. Message: One or more errors occurred.
Inner Exception : password_required_for_managed_user: Password is
required for managed user
The PC to run the program has joined AD, the user to run the program is also domain user. OS is windows 10.
Is there any further configuration need to be done on AAD to make it work?
.net
azure-active-directory adal wia asked Jun 19 '18 at 0:28
JamesJames
61
add a comment |
Try to run the project of active-directory-dotnet-native-headless, it works when acquiring token with username password. But failed and throw exception when acquiring token with Windows Integrated auth(WIA) as below:
//UserCredential uc = TextualPrompt();
// if you want to use Windows integrated auth, comment the line above and uncomment the one below
UserCredential uc = new UserCredential();
try
{
result = authContext.AcquireTokenAsync(todoListResourceId, clientId, uc).Result;
}
catch (Exception ee)
{
ShowError(ee);
return;
}
The error is:
An unexpected error occurred. Message: One or more errors occurred.
Inner Exception : password_required_for_managed_user: Password is
required for managed user
The PC to run the program has joined AD, the user to run the program is also domain user. OS is windows 10.
Is there any further configuration need to be done on AAD to make it work?
.net
azure-active-directory adal wia asked Jun 19 '18 at 0:28
JamesJames
61
You can't mix and match. Windows integrated authentication will never work for cloud (Azure AD). The fact that you are on a AD joined computer does not change the situation much. Azure AD only talks modern protocols - OpenID Connect, OAuth, not so m8dern - ws-federation and to some extend SAML. None of them is compatible with kerberos/ntlm, without additional work. Use app wothout windows integrated and find appropriate sample to work on.
– astaykov
Jun 19 '18 at 7:09
add a comment |
Try to run the project of active-directory-dotnet-native-headless, it works when acquiring token with username password. But failed and throw exception when acquiring token with Windows Integrated auth(WIA) as below:
//UserCredential uc = TextualPrompt();
// if you want to use Windows integrated auth, comment the line above and uncomment the one below
UserCredential uc = new UserCredential();
try
{
result = authContext.AcquireTokenAsync(todoListResourceId, clientId, uc).Result;
}
catch (Exception ee)
{
ShowError(ee);
return;
}
The error is:
An unexpected error occurred. Message: One or more errors occurred.
Inner Exception : password_required_for_managed_user: Password is
required for managed user
The PC to run the program has joined AD, the user to run the program is also domain user. OS is windows 10.
Is there any further configuration need to be done on AAD to make it work?
.net
azure-active-directory adal wia asked Jun 19 '18 at 0:28
JamesJames
61
Try to run the project of active-directory-dotnet-native-headless, it works when acquiring token with username password. But failed and throw exception when acquiring token with Windows Integrated auth(WIA) as below:
//UserCredential uc = TextualPrompt();
// if you want to use Windows integrated auth, comment the line above and uncomment the one below
UserCredential uc = new UserCredential();
try
{
result = authContext.AcquireTokenAsync(todoListResourceId, clientId, uc).Result;
}
catch (Exception ee)
{
ShowError(ee);
return;
}
The error is:
An unexpected error occurred. Message: One or more errors occurred.
Inner Exception : password_required_for_managed_user: Password is
required for managed user
The PC to run the program has joined AD, the user to run the program is also domain user. OS is windows 10.
Is there any further configuration need to be done on AAD to make it work?
.net
azure-active-directory adal wia .net
azure-active-directory adal wia asked Jun 19 '18 at 0:28
JamesJames
61
asked Jun 19 '18 at 0:28
JamesJames
61
asked Jun 19 '18 at 0:28
JamesJames
61
asked Jun 19 '18 at 0:28
JamesJames
61
asked Jun 19 '18 at 0:28
JamesJames
61
61
You can't mix and match. Windows integrated authentication will never work for cloud (Azure AD). The fact that you are on a AD joined computer does not change the situation much. Azure AD only talks modern protocols - OpenID Connect, OAuth, not so m8dern - ws-federation and to some extend SAML. None of them is compatible with kerberos/ntlm, without additional work. Use app wothout windows integrated and find appropriate sample to work on.
– astaykov
Jun 19 '18 at 7:09
add a comment |
You can't mix and match. Windows integrated authentication will never work for cloud (Azure AD). The fact that you are on a AD joined computer does not change the situation much. Azure AD only talks modern protocols - OpenID Connect, OAuth, not so m8dern - ws-federation and to some extend SAML. None of them is compatible with kerberos/ntlm, without additional work. Use app wothout windows integrated and find appropriate sample to work on.
– astaykov
Jun 19 '18 at 7:09
You can't mix and match. Windows integrated authentication will never work for cloud (Azure AD). The fact that you are on a AD joined computer does not change the situation much. Azure AD only talks modern protocols - OpenID Connect, OAuth, not so m8dern - ws-federation and to some extend SAML. None of them is compatible with kerberos/ntlm, without additional work. Use app wothout windows integrated and find appropriate sample to work on.
– astaykov
Jun 19 '18 at 7:09
You can't mix and match. Windows integrated authentication will never work for cloud (Azure AD). The fact that you are on a AD joined computer does not change the situation much. Azure AD only talks modern protocols - OpenID Connect, OAuth, not so m8dern - ws-federation and to some extend SAML. None of them is compatible with kerberos/ntlm, without additional work. Use app wothout windows integrated and find appropriate sample to work on.
– astaykov
Jun 19 '18 at 7:09
add a comment |
1 Answer
1
active
oldest
votes
You get this strange exception for a "managed" user when doing an Integrated Windows Auth (IWA) flow. Managed users are those created in AAD without an AD backing. IWA is based on an old protocol that works by calling some apis on the AD server. Since there is no AD server, we can't enable this flow.
I've updated the error messages on ADAL and MSAL and added details to the docs.
answered Nov 21 '18 at 18:17
Bogdan Gavril MSFTBogdan Gavril MSFT
11k84668
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f50919092%2fget-error-password-is-required-for-managed-user-when-authenticating-user-with%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
You get this strange exception for a "managed" user when doing an Integrated Windows Auth (IWA) flow. Managed users are those created in AAD without an AD backing. IWA is based on an old protocol that works by calling some apis on the AD server. Since there is no AD server, we can't enable this flow.
I've updated the error messages on ADAL and MSAL and added details to the docs.
answered Nov 21 '18 at 18:17
Bogdan Gavril MSFTBogdan Gavril MSFT
11k84668
add a comment |
You get this strange exception for a "managed" user when doing an Integrated Windows Auth (IWA) flow. Managed users are those created in AAD without an AD backing. IWA is based on an old protocol that works by calling some apis on the AD server. Since there is no AD server, we can't enable this flow.
I've updated the error messages on ADAL and MSAL and added details to the docs.
answered Nov 21 '18 at 18:17
Bogdan Gavril MSFTBogdan Gavril MSFT
11k84668
add a comment |
You get this strange exception for a "managed" user when doing an Integrated Windows Auth (IWA) flow. Managed users are those created in AAD without an AD backing. IWA is based on an old protocol that works by calling some apis on the AD server. Since there is no AD server, we can't enable this flow.
I've updated the error messages on ADAL and MSAL and added details to the docs.
answered Nov 21 '18 at 18:17
Bogdan Gavril MSFTBogdan Gavril MSFT
11k84668
You get this strange exception for a "managed" user when doing an Integrated Windows Auth (IWA) flow. Managed users are those created in AAD without an AD backing. IWA is based on an old protocol that works by calling some apis on the AD server. Since there is no AD server, we can't enable this flow.
I've updated the error messages on ADAL and MSAL and added details to the docs.
answered Nov 21 '18 at 18:17
Bogdan Gavril MSFTBogdan Gavril MSFT
11k84668
answered Nov 21 '18 at 18:17
Bogdan Gavril MSFTBogdan Gavril MSFT
11k84668
answered Nov 21 '18 at 18:17
Bogdan Gavril MSFTBogdan Gavril MSFT
11k84668
answered Nov 21 '18 at 18:17
Bogdan Gavril MSFTBogdan Gavril MSFT
11k84668
11k84668
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f50919092%2fget-error-password-is-required-for-managed-user-when-authenticating-user-with%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
You can't mix and match. Windows integrated authentication will never work for cloud (Azure AD). The fact that you are on a AD joined computer does not change the situation much. Azure AD only talks modern protocols - OpenID Connect, OAuth, not so m8dern - ws-federation and to some extend SAML. None of them is compatible with kerberos/ntlm, without additional work. Use app wothout windows integrated and find appropriate sample to work on.
– astaykov
Jun 19 '18 at 7:09