title: How to validate user credentials in Azure AD with Web application / WebAPI
body: <p>I have a web application. In the home page, user will enter the credentials, and system should validate against Azure AD and proceed further.</p>
  
  <p>When I use a native app, and use <code>UserCredentials</code>, it validates the user, but if I use same approach for WebAPI, it throw the exception</p>
  
  <blockquote>
    <p>The request body must contain the following parameter: 'client_secret
    or client_assertion'</p>
  </blockquote>
  
  <p>When I use the WebAPI using <code>clientCredentials</code>, it generates the accessToken, which do not validate the user credentials. I also tried passing the credentials as part of httpclient headers in the consequent calls, it is working despite the wrong credentials.</p>
  
  <pre><code>string AzureADSTSURL = "https://login.windows.net/{0}/oauth2/token?api-version=1.0";
  string GraphPrincipalId = "https://graph.windows.net";
  
  string userid = "userid";
  string password = "pass";
  
  string tenantId = "axxx";   //  webapi
  string clientId = "bxxx";
  string clientSecret = "cxxx";
  string authString = String.Format(AzureADSTSURL, tenantId);
  
  var context = new AuthenticationContext(authString);
  
  UserCredential userCredentials = new UserCredential(userid, password);
  AuthenticationResult authenticationResult = context.AcquireToken(GraphPrincipalId.ToString(), clientId, userCredentials); // this works only if the clientId corresponds to a native app
  
  ClientCredential clientCredential = new ClientCredential(clientId, clientSecret);
  AuthenticationResult result = context.AcquireToken(GraphPrincipalId, clientCredential);
  
  
  HttpClient httpClient = new HttpClient();
  httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(result.AccessToken, Convert.ToBase64String(UTF8Encoding.UTF8.GetBytes(userid + ':' + password)));
  
  httpClient.GetAsync("http://localhost:11455/Login.aspx");
  </code></pre>
  
  <p>Is there a way to validate the credentials without using native app? Graph API is not a right choice for this I believe.</p>