Finance | Project Operations, Human Resources, ...

Error with workflow authentication in on premise D365FinOps

(0) Share

Report

Posted on by Community Member

Hi All,

I am facing issue while opening workflow editor. Whenever I am opening workflow editor window, the login window immediately disappear. Both environment (SAT & PROD) are configured on same ADFS. The SAT environment is working fine and I had configured with another hard code Client ID.fd99fdbb-8843-489f-a8f6-27e9bea7a553 for the production environment. I don't know where the get default Client ID.

Below is the log captured from event viewer in ADFS server.

Encountered error during OAuth authorization request.

Additional Data

Exception details:
Microsoft.IdentityServer.Web.Protocols.OAuth.Exceptions.OAuthUnauthorizedClientException: MSIS9321: Received invalid OAuth request. The client '67ae0dc4-5f97-4c38-b132-65d38bbab8d1' is forbidden to access the resource 'ax.d365ffoprod.abcd.org'.
at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthProtocolContext.ValidateScopes(String scopeParameter, String clientId, String relyingPartyId)
at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthAuthorization.OAuthAuthorizationRequestContext.ValidateCore()

Thanks

Ahmer Khalid

I have the same question (0)

All responses (9)

Answers (0)

Ludwig Reinhard Microsoft Employee on at

Like (0)

Report

moved to the d365 forum

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

I think this is a d365 forum

Was this reply helpful? Yes No
Suggested answer

Luke Sha on at

Like (0)

Report

Hi, Ahmer

Please check below things in ADFS group

1. Make sure client ID "67ae0dc4-5f97-4c38-b132-65d38bbab8d1" is righ for workflow native application

2. Make sure redirect URL of workflow native application include both of below items

dynamicsaxworkfloweditor/

dynamicsaxworkfloweditor/

3. Make sure "ax.d365ffoprod.abcd.org" is included in relying URL of Native application and Web API

4. Make sure workflow application is added into 'Client permission' list of WebAPI

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

I am using Client ID.fd99fdbb-8843-489f-a8f6-27e9bea7a553 for Production environment.

this client ID "67ae0dc4-5f97-4c38-b132-65d38bbab8d1" for UAT (it is working fine).

Both URI are already added on workflow Native Application.

Thanks

Ahmer Khalid

Was this reply helpful? Yes No
Suggested answer

Luke Sha on at

Like (0)

Report

Hi, Ahmer

What you mean "I am using Client ID.fd99fdbb-8843-489f-a8f6-27e9bea7a553 for Production environment. this client ID "67ae0dc4-5f97-4c38-b132-65d38bbab8d1" for UAT (it is working fine)."?

The client ID of workflow is 67ae0dc4-5f97-4c38-b132-65d38bbab8d1 is fixed for all the environments and all the customers

If you change the ADFS application group deployment script manually to create workflow application for PROD, that's wrong.

Please follow the standard procedure. (ADFS parts in below link)

docs.microsoft.com/.../troubleshoot-on-prem

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

Hi Luke,

Thanks for your update.

As you know, Client ID is unique. so i am unable to create Application Group for production environment Thats the key reason for changing the Client ID.

For now what can i do for it.

Thanks

Ahmer Khalid

Was this reply helpful? Yes No
Luke Sha on at

Like (0)

Report

No problem, Ahmer.

If you work it out by following the provided link, please help to mark the solution as 'Answer'.

Have a good day.

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

Hi Luke,

I am unable to connect the workflow server from production environment.

Thanks

Ahmer Khalid

Was this reply helpful? Yes No
Suggested answer

Luke Sha on at

Like (0)

Report

Hi, Ahmer

Please be specific on issues. What's changes you have done now?

As introduced in the document, we need to share same Native / Workflow /Financial reporting client ID for both PROD and UAT

docs.microsoft.com/.../troubleshoot-on-prem

Suggest you to redeploy your PROD with correct configuration.

Was this reply helpful? Yes No