title: Why does AcquireToken with ClientCredential fail with invalid_client (ACS50012)?
body: <p>Why won't my Azure AD application allow an oauth client_credentials grant?</p>
  
  <p>I want to use the Azure Graph API, but first I need an oauth token. To get the token, I am trying to use Microsoft.IdentityModel.Clients.ActiveDirectory aka ADAL version 1.0.3 (from NuGet).</p>
  
  <p>I'm using the overload of AuthenticationContext.AcquireToken that takes a ClientCredential object. (I can't use the overload that prompts the user to login because I'm writing a service, not an app.)</p>
  
  <p>I configured my Azure AD web application as described in various tutorials/samples (e.g. <a href="http://code.msdn.microsoft.com/windowsazure/AAL-Server-to-Server-9aafccc1" rel="noreferrer">ADAL - Server to Server Authentication</a>).</p>
  
  <p>My code looks like:</p>
  
  <pre><code>AuthenticationContext ac = new AuthenticationContext("https://login.windows.net/thommmondago.onmicrosoft.com");
  ClientCredential cc = new ClientCredential("41151135-61b8-40f4-aff7-8627e9eaf853", clientSecretKey);
  AuthenticationResult result = ac.AcquireToken("https://graph.windows.net", cc);
  </code></pre>
  
  <p>The <code>AcquireToken</code> line throws an exception:</p>
  
  <pre><code>sts_token_request_failed: Token request to security token service failed.  Check InnerException for more details
  </code></pre>
  
  <p>The inner exception is a WebException, and the response received looks like an oauth error:</p>
  
  <pre><code>{ "error":"invalid_client",
   "error_description":"ACS50012: Authentication failed."
   "error_codes":[50012],
   "timestamp":"2014-03-17 12:26:19Z",
   "trace_id":"a4ee6702-e07b-40f7-8248-589e49e96a8d",
   "correlation_id":"b304af2e-2748-4067-99d0-2d7e55b121cd" }
  </code></pre>
  
  <p>Bypassing ADAL and using curl with the oauth endpoint also gives the same error.</p>
  
  <p>My code works if I use the details of the Azure application that I found <a href="https://github.com/MSOpenTech/AzureAD-Node-Sample/wiki/Windows-Azure-Active-Directory-Graph-API-Access-Using-OAuth-2.0" rel="noreferrer">here</a>:</p>
  
  <pre><code>AuthenticationContext ac = new AuthenticationContext("https://login.windows.net/graphDir1.onmicrosoft.com");
  ClientCredential cc = new ClientCredential("b3b1fc59-84b8-4400-a715-ea8a7e40f4fe", "FStnXT1QON84B5o38aEmFdlNhEnYtzJ91Gg/JH/Jxiw=");
  AuthenticationResult result = ac.AcquireToken("https://graph.windows.net", cc);
  </code></pre>
  
  <p>So it's not an error with my code. I think it's either an error with my Azure AD, or I've got the ClientCredential parameters wrong.</p>