Jet Hub Office365 Login Fails with 500 Error Expired Micorsoft Entra Client Secret

Issue

When users try to sign in to Jet Hub using Microsoft 365 authentication, they may see a 500 server error.. When this occurs, check the URL for an error message similar to the following:

https://jethub.instance_name/Error?message=Message contains error: 'invalid_client', error_description: 'AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'. Trace ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Correlation ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Timestamp: YYYY-MM-DD HH:MM:SSZ'

The AADSTS7000218 error code indicates the Microsoft Entra app client secret has expired or is missing.

Cause

The client secret configured for the Microsoft Entra app used by Jet Hub has expired. The expired secret must be replaced in the Jet Hub configuration file and re-encrypted.

Resolution

Step 1: Generate a new client secret in Microsoft Entra

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com).

2. Go to the Microsoft Entra app registered for Jet Hub authentication.

3. Under Certificates & secrets, select New client secret.

4. Copy the value of the new secret immediately after creation. This value is only visible once.

Step 2: Update the appsettings.xml file

1. On the server where Jet Hub is installed, open Notepad as an administrator (right-click Notepad and select Run as administrator).

2. In Notepad, go to File > Open.

3. Paste this path into the File name box and press Enter:

   C:\Program Files (x86)\Jet Hub\Identity\appsettings.xml

4. Click Ctrl + F, type MicrosoftGraphClientSecret, and click Enter on keyboard to go to the tag.

5. Replace the existing value between the opening and closing tags with the new secret value copied in Step 1.

6. Save the file.

Step 3: Re-encrypt the secret and restart services

1. Open Command Prompt as an administrator.

2. Run the following command:

   iisreset

3. Restart the Jet Service Tier (JST).

4. Go to the Jet Hub landing page. The value in appsettings.xml is now encrypted and Jet Hub uses the new secret for authentication.'

Additional Notes

The MicrosoftGraphClientSecret value in appsettings.xml is stored in encrypted form after the first IIS reset following a plaintext update. If the value appears as a long encrypted string in the file, this is expected behavior.