{"record":{"id":"c6029b60f85dda59","repo":"gravitational/teleport","slug":"invalid-graph-api-credentials","errorCode":null,"errorMessage":"invalid Graph API credentials","messagePattern":"invalid Graph API credentials","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/msgraph/creds.go","lineNumber":36,"sourceCode":"// the Graph API and if they're authorized to get specific resources.\npackage msgraph\n\nimport (\n\t\"context\"\n\t\"errors\"\n\t\"net/http\"\n\t\"slices\"\n\n\t\"github.com/gravitational/trace\"\n)\n\nvar (\n\t// ErrTenantNotFound is returned by [Client.VerifyCredentials] when getting a token fails due to\n\t// the tenant not being found. It might also point to the subscription no longer being active.\n\tErrTenantNotFound = errors.New(\"tenant not found\")\n\t// ErrInvalidCredentials is returned by [Client.VerifyCredentials] when getting a token fails due\n\t// to an invalid client ID or secret.\n\tErrInvalidCredentials = errors.New(\"invalid Graph API credentials\")\n\t// ErrClientUnauthorized is returned by [Client.VerifyCredentials] in a situation where the app\n\t// either doesn't have the permission required to access certain resources or the permission\n\t// hasn't been grated by the administrator yet.\n\tErrClientUnauthorized = errors.New(\"authentication was successful but application does not have necessary permissions\")\n)\n\n// IsCredentialsError determines whether err is one of the special errors returned by\n// [Client.VerifyCredentials].\nfunc IsCredentialsError(err error) bool {\n\treturn errors.Is(err, ErrTenantNotFound) ||\n\t\terrors.Is(err, ErrInvalidCredentials) ||\n\t\terrors.Is(err, ErrClientUnauthorized)\n}\n\n// VerifyCredentials expects getResourcesFunc to call a method on [Client]. It then inspects the\n// returned error to check for Graph or token errors related to credentials being insufficient in\n// some way.\nfunc (c *Client) VerifyCredentials(ctx context.Context, getResourcesFunc func(ctx context.Context, client *Client) error) error {","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/msgraph/creds.go#L18-L54","documentation":"Exported sentinel ErrInvalidCredentials returned by msgraph Client.VerifyCredentials when Azure AD rejects the client ID or client secret during token acquisition; it also appears in webauthn login (different sentinel, same message shape) when a user has only invalid WebAuthn registrations.","triggerScenarios":"Thrown at lib/msgraph/creds.go:36 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the client ID and client secret configured in the Azure/Entra integration and rotate them if stale","For the WebAuthn variant, perform a user reset (tsh admin) to clear invalid registrations"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}