I've added a new endpoint which will allow users to get around issues with client_id not being present in the POST request generated by Grafana.

[lukeplausin]

See grafana/grafana#5877

[jayme-github]

Hi, thanks for your contribution!
I tried to figure out why we don't need this in our environment.
I followed the discussion starting from grafana/grafana#5877 (comment) and it seems the only difference is that we're using grafana 4.5.1 and profile = openid,email,profile did you tried that?

According to Microsoft (https://login.microsoftonline.com/.../.well-known/openid-configuration) our endpoint should not support basic auth header ("token_endpoint_auth_methods_supported":["client_secret_post","private_key_jwt"]). Strange.
I don't remember correctly how out post body's looked during initial debugging, will check back with @Nin-0 on this.

[NilsGriebner]

Hi,
thanks for your contribution and sorry for the late response. I tried to reproduce this today and it's not occuring in my lab using Grafana version 4.5.1 or 4.5.2. The only difference is, that I'm using the endpoints already pointed out by @jayme-github, so I think this is maybe related to your config ? Please correct me if I misunderstood.

[lukeplausin]

Hi

I'm using Grafana v4.5.2 (commit: ec2b0fe) according to the login dash. I actually had my config set up as scopes = openid,email,profile, I tried it again with profile = openid,email,profile and I still get the 400 error when Grafana tries to fetch the token..

AADSTS90014: The request body must contain the following parameter: 'client_id'

I also tried changing the hostname from login.windows.net to login.microsoftonline.com, then the error message changes to AADSTS50001: Resource identifier is not provided.. Maybe it's possible that we were using different Microsoft APIs?

Anyway, this configuration works for me, I thought I'd share it in case anyone else is up against the same issues.

[NilsGriebner]

Hi,
could be possible. Maybe you have registered your App in Azure Portal in a different way? I will try to figure out how we done this.

[lukeplausin]

I'm afraid I can't check this, I don't have admin rights to our directory :(

[NilsGriebner]

We registered our app in https://aad.portal.azure.com -> Enterprise Applications. Is your app registered there, too?