How to diagnose "'AADB2C90289: We encountered an 'invalid_client' error connecting to the identity provider."

Question

How to diagnose "'AADB2C90289: We encountered an 'invalid_client' error connecting to the identity provider."

Adam Collings 5

We have a Blazor application hosted in Azure which uses Microsoft Identity to authenticate the user.

This has worked without incident for several years.

As of last Friday night, any user trying to log into the system receives the following error after entering their login details.

“Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[12] Message contains error: 'server_error', error_description: 'AADB2C90289: We encountered an 'invalid_client' error connecting to the identity provider. Please try again later.”

This is happening consistently every time.

No changes to any Azure configuration have occurred.

No code changes in our application were deployed on Friday (or since)

We are using a custom Azure AD B2C policy to support multiple Azure ADs (multi-tenant).

I have been looking through Azure portal, researching online, and speaking to a former colleague, for 7 hours but really don't know where to begin diagnosing or resolving this problem.

My best guess is that some kind of configuration (perhaps a "client secret") has expired but I'm not sure how to figure out which secret, and what to do about it.

Is anyone able to give me some guidance as to how to proceed?

Anonymous

2024-05-22T21:40:24.4733333+00:00

Hi @Adam Collings , did you need any more help with this question? If not could you please mark "Accept Answer" on the appropriate answer so other users can reference it?

Thank you,

James

2 answers

Your answer

Anonymous

2024-05-22T21:40:24.4733333+00:00

Hi @Adam Collings , did you need any more help with this question? If not could you please mark "Accept Answer" on the appropriate answer so other users can reference it?

Thank you,

James

Answer 1

Hi @Adam Collings , The error message "invalid_client" usually indicates that the client ID or client secret is incorrect or has expired.

To diagnose and resolve this issue, you can try the following steps:

Check the client ID and client secret in your Azure AD B2C policy. Make sure that they are correct and have not expired. You can find the client ID and client secret in the "Keys" section of your Azure AD B2C application registration.
Check the expiration date of the client secret. If the client secret has expired, you will need to generate a new one and update your Azure AD B2C policy with the new value.
Check the Azure AD B2C logs for more information about the error. You can find the logs in the Azure portal under "Azure AD B2C" > "Logs". Look for any errors related to the authentication process or the client ID/secret.
If you are still unable to resolve the issue, you can try creating a new Azure AD B2C application registration and updating your policy to use the new client ID and secret. This will help you determine if the issue is related to the application registration or the policy configuration.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James

Adam Collings 5 Reputation points

2024-05-23T01:03:20.4166667+00:00

Thanks, James. I had taken over two weeks and the help of an external consultant, but I finally managed to track down the relevant expired secrets, and the places where they needed to be updated.

One expired key was referenced in our code via an environment variable on Azurep roduction. The other was harder to track down. Our policy XML file referenced a "policy key". That policy key needed to be modified to hold the newly created client secret.

I've come out of this with a greater understanding of all this, and a lot more documentation for the future (as we'll need to go through this all again in two years).

Thanks for your help.

Answer 2

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more