title: Why is my "access grant malformed" in Azure AD?
body: <p>I'm trying to get single sign-on working in Azure Active Directory, using <a href="http://msdn.microsoft.com/en-us/library/azure/dn645542.aspx" rel="nofollow">this bit of documentation</a> as a guide. However, when I get up to the "access token request" stage, I get the following error:</p>
  
  <blockquote>
    <p>Error validating credentials. AADSTS70000: The provided access grant is invalid or malformed.</p>
  </blockquote>
  
  <p>Searching the Internet, it seems that this is usually caused by the <code>redirect_uri</code> parameter being missing in the second step or different between the two steps, but that doesn't seem to be the case here.</p>
  
  <p>Here's what's happening in each step:</p>
  
  <p>Authorize step (raw HTTP request from browser):</p>
  
  <pre><code>GET /[snip tenant id]/oauth2/authorize?redirect_uri=http%3A%2F%2Flocalhost%3A5000%2Fpost-login%3Fdest%3D%252F&amp;response_type=code&amp;client_id=[snip client id] HTTP/1.1
  Host: login.windows.net
  Connection: keep-alive
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
  Accept-Encoding: gzip, deflate, sdch
  Accept-Language: en-AU,en;q=0.8,en-US;q=0.6
  Cookie: [snip a handful of cookies]
  </code></pre>
  
  <p>Redirect step (raw HTTP request from browser):</p>
  
  <pre><code>GET /post-login?code=[snip base64]&amp;session_state=[snip uuid] HTTP/1.1
  Host: localhost:5000
  Connection: keep-alive
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
  Accept-Encoding: gzip, deflate, sdch
  Accept-Language: en-AU,en;q=0.8,en-US;q=0.6
  Cookie: csrftoken=vBjLMAFTw7NSFEJHb2t9GTA0Eoced4rw; azure-redirect-uri="http://localhost:5000/post-login?dest=%2F"
  </code></pre>
  
  <p>Token request step (raw HTTP request from server code):</p>
  
  <pre><code>POST /[snip tenant id]/oauth2/token HTTP/1.1
  Host: login.windows.net
  Content-Length: 805
  Accept-Encoding: gzip, deflate
  Accept: */*
  User-Agent: python-requests/2.5.0 CPython/2.7.6 Darwin/14.0.0
  Connection: keep-alive
  Content-Type: application/x-www-form-urlencoded
  
  redirect_uri=http%3A%2F%2Flocalhost%3A5000%2Fpost-login%3Fdest%3D%252F&amp;client_secret=Dsysz7F%2FXh2Wu1YKE%2BVEOkvMHhvc38DnwFTa5qekyXM%3D&amp;code=[snip base64]&amp;client_id=[snip client id]&amp;grant_type=authorization_code
  </code></pre>
  
  <p>Response to token request (Python dict parsed from JSON returned):</p>
  
  <pre><code>{
      u'timestamp': u'2014-12-09 05:37:58Z', 
      u'trace_id': u'ae00a782-30f1-4e1c-a183-f19330ecca37',
      u'submit_url': None, 
      u'correlation_id': u'21a7b861-5171-4083-9da5-67e7d956ab5e',
      u'error_description': u'AADSTS70002: Error validating credentials. AADSTS70000: The provided access grant is invalid or malformed.\r\nTrace ID: ae00a782-30f1-4e1c-a183-f19330ecca37\r\nCorrelation ID: 21a7b861-5171-4083-9da5-67e7d956ab5e\r\nTimestamp: 2014-12-09 05:37:58Z',
      u'context': None, 
      u'error': u'invalid_grant',
      u'error_codes': [70002, 70000]
  }
  </code></pre>