The sample I'm using is using Resource owner password credentials flow for authentication. With this authentication flow, my application just sends the username and password to Azure AD. However, Azure AD using WS-Trust with ADFS to send username or password. However the ROPC has some limitations and it may not work for this federated user accounts.
Microsoft suggests this:
You can try to use Direct Authentication for federated user accounts if you cannot use WS-trust.
Azure AD has turned off the ability (by default) for customers to utilize the legacy-based authentication method of Direct Authentication for federated user accounts.
Direct Authentication for federated user accounts is the means of utilizing an Azure AD stored Password Hash to authenticate a federated user directly with Azure AD and retrieving a token from us without being sent to the Identity Provider for the account. As you probably have noticed, this ‘feature’ isn’t the best from a security perspective.
There is a way to turn this back on for the customer but we recommend you only do so on a per-app basis since the nature of this change will open the customer up to legacy authentication mechanisms for their entire tenant. The script supplied to customers who have one (1) application to turn this on with is as follows:
- Enable both of Password hash synchronization and Federation with ADFS in Azure AD Connect sync.
- Install the Azure AD Preview PowerShell Module.
- Run the following line-by-line (making sure the variable $sp doesn’t have more than 1 application as a result)
Connect-AzureAD
$sp = Get-AzureADServicePrincipal -SearchString "Name_Of_Application"
$policy = New-AzureADPolicy -Definition @("{`"HomeRealmDiscoveryPolicy`":{`"AllowCloudPasswordValidation`":true}}") -DisplayName EnableDirectAuth -Type HomeRealmDiscoveryPolicy -IsOrganizationDefault $false
Add-AzureADServicePrincipalPolicy -Id $sp.ObjectId -RefObjectId $policy.Id
HTH!
