A custom client (such as handheld-scanner software) authenticating to IFS via ADFS with an explicit resource parameter gets an 'unauthorized_client' error, even though the resource value used matches what the middleware server's own logging says it expects, and using any other resource value produces a 401 instead.

All FAQ questions / Security and access

Answer

Check the actual Identifier configured on the relevant WebAPI in ADFS — per IFS's own ADFS setup documentation, this Identifier has to follow the exact pattern api://<INSTANCE_NAME>; documentation suggesting it could alternatively be set to something like the application server's own URL is misleading and doesn't actually work with how the middleware server sets its resource parameter in requests. If you've ended up with two separate WebAPIs (one incorrectly identified, one correctly following the api://<INSTANCE_NAME> pattern), delete the incorrectly-identified one and instead add your custom/native client application's Client Permissions directly onto the single, correctly-identified WebAPI, granting it the openid and user_impersonation scopes — a single correctly-identified WebAPI can support both a native/public client and a confidential/web client with a secret at the same time, rather than needing a separate WebAPI per client type.

Documentation-based answer. Confirm the product and release before applying it. This answer has not been verified in an IFS environment.

← Browse Security and access questions