Login to Sharepoint Online failure

Question

We have a code that logins to Sharepoint Online using : https://login.microsoftonline.com/extSTS.srf or https://login.microsoftonline.com/RST2.srf, but recently we starting to get authentication failed saying that "Incorrect Username or Password" and after some retries it returns:

"0x80048823 message : AADSTS70002: Error validating credentials. AADSTS50053: You've tried to sign in too many times with an incorrect user ID or password."

While using same username and password to login in the browser works fine, and neither password or username were changed, also code didn't changed. As same code works fine for another Sharepoint tenants. Seems that something changed in the Microsoft login servers, where it's started to not accept user credentials, while web browser login works fine.

Please advise.

Thanks

Answer 1

So I think I understand what they are trying to say. There are 2 paths that you are able to authenticate with according to the node-sp-auth example.

"Managed" and "Federated"

"Managed" was the easier version and allowed for you to be able to just provide username and credentials in a soap assertion to login.

Federated is a lot more complicated. You need to first perform a post to Microsoft to validate the user hitting your adfs server. https://adfs.XXXXXXX.com/adfs/services/trust/13/usernamemixed

Then you take the saml:Assertion from that response and put it into the "Token" section of the call you make to https://login.microsoftonline.com/extSTS.srf utilizing the templates from the node-sp-auth.

I have C# code that performs all these steps but I am getting an error AADSTS70002: Error validating credentials. AADSTS50008: SAML token is invalid. AADSTS50006: Invalid signature. Signature verification failed.

Even though the signature is being generated by Microsoft in their SAML.

node-sp-auth code refrence is OnlineUserCredential.ts file.

If someone can figure out the last mile I can post a comprehensive C# solution.

Answer 2

Microsoft Rep has helped me get this far.

They had us create a "Cloud Only" user. This user was setup as "@" so if your name is bill and your corporate sharepoint site is name is FakeCompany.sharepoint.com then you would have the person as "[email protected]"

This user was able to login to https://login.microsoftonline.com/extSTS.srf by just passing username and password.

Our on prem AD users are still having issues, i mentioned this and got the following response.

There is no issue with sync as you are able to login to portal using the same account and password. The solution you need is documented in https://learn.microsoft.com/en-gb/azure/active-directory/manage-apps/configure-authentication-for-federated-users-portal#enable-direct-authentication-for-legacy-applications

You need to create a home realm discovery (HRD) policy where "AllowCloudPasswordValidation":true.

We have not yet implemented the last solution but the creating of a cloud account may help some of you.