Skip to content
This repository has been archived by the owner on Jun 30, 2023. It is now read-only.

Acquiring tokens with username and password

Jean-Marc Prieur edited this page Feb 13, 2018 · 12 revisions

For historical reasons, ADAL.NET supports in some platforms (.NET framework) the user name and password flow.

Using username and password is not recommended

In general Microsoft does not advice customers to use it as it's less secure than the other flows, and it is not compatible with conditional access (as if the resource requires conditional access, the call to AcquireTokenSilent will just fail, given that this is not an interactive flow, the STS does not have an opportunity to present a dialog to the user to tell him/her that s/he needs to do multiple factor authentication).

For more information about why you want to avoid using this grant, you can, for instance read the following article which explains why Microsoft is working to make passwords a thing of the past

Getting a token with a username and password

you can get a token with a username and password by calling the same override as for the integrated windows authentication. This method can be used both in federated tenants or with Azure AD. This method is not available part of the AuthenticationContext class, but as an AcquireTokenAsync extension method of the AuthenticationContextIntegratedAuthExtensions class. This extension method takes as a parameter, in addition to the resource and clientId of the public client application an instance of UserCredential, which in fact is even an instance of UserPasswordCredential

image

Clone this wiki locally