Running my DXA 1.7 I', seeing a YSOD:

Unauthorized Request -- Please check your configuration settings to make sure your authentication details are correct.

Checking site.log I can see the following:

2017-03-21 11:47:09,158 [1] INFO  - -------- Initializing DXA Framework v1.7.0.309 --------
2017-03-21 11:47:09,206 [1] INFO  - Using implementation type 'Sdl.Web.Common.Logging.Log4NetLogger' for interface ILogger.
2017-03-21 11:47:09,284 [1] INFO  - Using implementation type 'Sdl.Web.Tridion.Caching.DefaultCacheProvider' for interface ICacheProvider.
2017-03-21 11:47:09,341 [1] INFO  - Using implementation type 'Sdl.Web.Tridion.Mapping.DefaultContentProvider' for interface IContentProvider.
2017-03-21 11:47:09,343 [1] INFO  - Using implementation type 'Sdl.Web.Tridion.Navigation.StaticNavigationProvider' for interface INavigationProvider.
2017-03-21 11:47:12,416 [1] ERROR - An error occurred while processing this request.
Microsoft.OData.Client.DataServiceQueryException: An error occurred while processing this request. ---> Microsoft.OData.Client.DataServiceClientException: {"error":"invalid_grant"}
   at Microsoft.OData.Client.QueryResult.ExecuteQuery()
   at Microsoft.OData.Client.DataServiceRequest.Execute[TElement](DataServiceContext context, QueryComponents queryComponents)
   --- End of inner exception stack trace ---
   at Microsoft.OData.Client.DataServiceRequest.Execute[TElement](DataServiceContext context, QueryComponents queryComponents)
   at Microsoft.OData.Client.DataServiceQuery`1.GetEnumerator()
   at System.Linq.Enumerable.FirstOrDefault[TSource](IEnumerable`1 source)
   at Microsoft.OData.Client.DataServiceQueryProvider.ReturnSingleton[TElement](Expression expression)
   at Sdl.Web.Context.OData.Client.Caller.ODataContextEngineServiceClient..ctor()
   at Sdl.Web.Context.OData.Client.ODataContextEngine..ctor()
   at Sdl.Web.Tridion.Context.ContextServiceClaimsProvider..cctor() in C:\Jenkins\workspace\DXA Dev CI Web App .NET\Sdl.Web.Tridion\Context\ContextServiceClaimsProvider.cs:line 35
2017-03-21 11:47:12,428 [1] INFO  - Using implementation type 'Sdl.Web.Tridion.Context.ContextServiceClaimsProvider' for interface IContextClaimsProvider.
2017-03-21 11:47:12,430 [1] INFO  - Using implementation type 'Sdl.Web.Tridion.Linking.DefaultLinkResolver' for interface ILinkResolver.
2017-03-21 11:47:12,432 [1] INFO  - Using implementation type 'Sdl.Web.Tridion.Mapping.DefaultRichTextProcessor' for interface IRichTextProcessor.
2017-03-21 11:47:12,433 [1] INFO  - No implementation type configured for optional interface IConditionalEntityEvaluator.
2017-03-21 11:47:12,436 [1] INFO  - Using implementation type 'Sdl.Web.Mvc.Html.BaseMediaHelper' for interface IMediaHelper.
2017-03-21 11:47:12,442 [1] INFO  - Using implementation type 'Sdl.Web.Tridion.CdApiLocalizationResolver' for interface ILocalizationResolver.
2017-03-21 11:47:12,444 [1] INFO  - Using implementation type 'Sdl.Web.Mvc.Statics.BaseStaticFileManager' for interface IStaticFileManager.
2017-03-21 11:47:12,445 [1] INFO  - No implementation type configured for optional interface IUnknownLocalizationHandler.

This looks like there's an issue connecting to the SDL Web Context Service?

Checking my Discovery service, I can see the Context Service is registered as a capability:

And even though I'm having an issue installing the Context Service as a Windows Service, I can run it from start.ps1 and if I try and browser I get the same invalid grant error from http://localhost:8087/context.svc.

I'm not quite sure what to check for next - from the logs it looks like the query to the Context Service has been made unauthenticated - so without getting a token first?

Is that right? Am I missing some configuration?

UPDATE

So my Context Service now starts and using DEBUG I can see the following in it's logs:

2017-03-22 08:57:26,460 DEBUG VariableResolverUtil - Found parameter: ${oauthenabled:-true}. Resolved value: true

So I assume OAuth is on for the Context Service. I found the same line when logging the Discovery Service and Content Services.

Everything looks ok. One confusing thing I did notice is and error logged against the ContentServiceProvider in the cd_client.log:

2017-03-22 9:28:40 DEBUG [Sdl.Web.Delivery.ADF.HttpModule..cctor] - Ambient Data context initialization.
2017-03-22 9:28:41 DEBUG [Sdl.Web.Delivery.DiscoveryService.DiscoveryServiceProvider..ctor] - Attempting to construct discovery-service provider.
2017-03-22 9:28:43 DEBUG [Sdl.Web.Delivery.Service.OAuthTokenProvider..ctor] - Using token-service: http://10.10.1.132:8082/token.svc
2017-03-22 9:28:43 DEBUG [Sdl.Web.Delivery.Service.OAuthTokenProvider.CreateOrRefreshToken] - Attempting to get token from token-service.
2017-03-22 9:28:43 DEBUG [Sdl.Web.Delivery.DiscoveryService.DiscoveryServiceProvider..ctor] - Finished constructing discovery-service provider.
2017-03-22 9:28:43 ERROR [Sdl.Web.Delivery.ContentService.ContentServiceProvider..ctor]
        Problem authenticating with service. Please make sure your authentication settings are correct and you have enabled authentication.

But the error is still coming from the ContextServiceClaimsProvider in site.log (shown above).

I guess this is the same root cause?