Azure AD error while parsing OAuth2 callback: invalid_client

Question

I have an application registered in Azure AD using https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app When trying to login to my app to connect to Microsoft Login. I am getting invalid client error. In logs I seen following error.

error=invalid_client&error_description="AADSTS650052 The app needs access to a service (https://aks-aad-server.azure.com) that your organization xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx has not subscribed to or enabled. Contact your IT Admin to review the configuration of your service subscriptions"

Note: I have Microsoft Office 365 standard subscription plan,

Answer 1

AADSTS650052 The app needs access to a service ( https://aks-aad-server.azure.com ) that your organization xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx has not subscribed to or enabled. Contact your IT Admin to review the configuration of your service subscriptions

To resolve the above error, please check the below workarounds

• While registering the application in Azure AD, check the supported account type you have selected

• If you selected “single tenant” you can't login to your application
  from different tenant

• To access your application from different tenant update supported
  account type to “multi-tenant”

To know how to do that in detail refer this link:

https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-convert-app-to-be-multi-tenant#update-registration-to-be-multi-tenant

• After registering the application, navigate to Exposing an API and set App ID URI and Add required scopes such as read, user impersonation etc.

• Add Client ID of your Application to knownClientApplications parameter in the Manifest

Your admin needs to accept the consent prompt to access this application use the below URL by updating the ClientID parameter with your application client-id

https://login.microsoftonline.com/common/oauth2/authorize?client_id=1a8e25b8-xxxx-xxxx-xxxx-xxxxxxxxxxxx&prompt=admin_consent&response_type=code 

When your admin granted those permission, you can login to your application successfully

Reference:

https://learn.microsoft.com/en-us/answers/questions/28697/invalid-client-aadsts650052-the-app-needs-access-t.html

Answer 2

Found the wrong scope in the oauth2-proxy configuration which sending incorrect request to azure and after updating the scope to correct the issue is resolved.