Hi all;
We are working with a client to deploy the new Dynamics 365 App for Outlook in their environment (CRM: Dynamics 365 Update 2.1, Claims/IFD, Server 2016; Client: Win10/Office 2016).
We have successfully deployed the D365 app, but upon activation in Outlook, users are first presented with an ADFS pop-up window, asking for credentials. After entering credentials, the user gets a "We're sorry - Something went wrong during sign-in" error.
On the server, there are several ADFS errors that appear:
ADFS Error 1020: Microsoft.IdentityServer.Web.Protocols.OAuth.Exceptions.OAuthUnauthorizedClientException: MSIS9321: Received invalid OAuth request. The client '806e5da7-0600-e611-80bf-6c3be5b27d7a' is forbidden to access the resource 'auth.alberdingkusa.com'. at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthProtocolContext.ValidateScopes(String scopeParameter, String clientId, String relyingPartyId) at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthAuthorization.OAuthAuthorizationRequestContext.ValidateCore()
ADFS Error 364: Microsoft.IdentityServer.Web.Protocols.OAuth.Exceptions.OAuthUnauthorizedClientException: MSIS9321: Received invalid OAuth request. The client '806e5da7-0600-e611-80bf-6c3be5b27d7a' is forbidden to access the resource 'auth.alberdingkusa.com'. at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthProtocolContext.ValidateScopes(String scopeParameter, String clientId, String relyingPartyId) at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthAuthorization.OAuthAuthorizationRequestContext.ValidateCore() at Microsoft.IdentityServer.Web.Protocols.ProtocolContext.Validate() at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthAuthorization.OAuthAuthorizationProtocolHandler.GetRequiredPipelineBehaviors(ProtocolContext pContext) at Microsoft.IdentityServer.Web.PassiveProtocolListener.EvaluateHomeRealm(PassiveProtocolHandler protocolHandler, ProtocolContext protocolContext) at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)
ADFS Error 1021: Microsoft.IdentityServer.Web.Protocols.OAuth.Exceptions.OAuthAccessTokenMissingAuthorizationCodeException: MSIS9246: Received invalid OAuth access token request. The 'code' parameter is missing or found empty. at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthAccessTokenRequestContext.ValidateCore()
____________________________________________
The ADFS relying parties on the ADFS server have been deleted and rebuilt using powershell.
Access Control Policies for both have been set to Permit Access to All Users.
The ADFSClient for the D365 App for Outlook has been set.
Access via the web UI is normal.
*This post is locked for comments