TokenHelper method GetAccessToken throwing error while executing AcsMetadataParser.GetStsUrl.

InnerException = {"No connection could be made because the target machine actively refused it"}

Why would the Microsoft ACS refuse the connection and what is the resolution.

Environment details -
I am working on a sample Low Trust Add in with Add in deployed onto dev site on free dev subscription of Office 365 and add in web is hosted on the IIS and Virtual Directory mapped to the VS 2015 Community Edition's web project.

Ref. for the set up - Step by Step Procedure to Create a Low Trust Provider Hosted App for Office 365 and Host the AppWeb in Local IIS

Update -

Upon further debugging I found the issue is thrown by the WebClient object inside GetMetadataDocument method. It throws the exception when it tries to download metadata file from ACS.

I took this acsMetadataEndpointUrlWithRealm and browsed it. The URL returned a JSON file. I haven't for now, figured why the downloading of this JSON file is failing in the TokenHelper.

Update 2 -
I ran a console app and webclient object was able to get bit stream without exception

    private static void GetMetadataDocument()
            string acsMetadataEndpointUrlWithRealm = "https://accounts.accesscontrol.windows.net/metadata/json/1?realm=[put value here]";
            byte[] acsMetadata;
            using (WebClient webClient = new WebClient())

                acsMetadata = webClient.DownloadData(acsMetadataEndpointUrlWithRealm);

        catch (Exception ex)
            throw ex;

1 Answer 1


For sometime into this issue, I have been wondering that it had to do with firewall, but as I don't have much control over organizational firewall settings, I struggled to get the right configurations.

First, I had got my machines firewall switched off completely, but it didn't help. Then I switch my focus to web.config settings. I was able to get it working with the following entries.

  <defaultProxy useDefaultCredentials="true">
    <proxy bypassonlocal="True" proxyaddress="[proxyurl:port]" usesystemdefault="True"/>
    <httpWebRequest useUnsafeHeaderParsing="true" />

Note - proxy url was sourced by company IT team, which they have for such pass through request.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.