We have an API which we use for our .NET application, but we also want to make calls directly from postman. The current setup uses the Authorization Type OAuth 2.0 build in functionality of postman. Which opens a popup of our Azure AD B2C sign-in screen.
We are using custom policies to sign-in here as well.
My question is, is there a way to simply use postman (preferably in 1 request) to get the access token without having to use the browser and sign-in manually?
I tried to reproduce the same in my environment and got the below results:
As mentioned by Jas Suri, you can make use of ROPC Flow to generated access token without browser interaction.
I created an Azure AD B2C application and enabled Allow public client flows option:
Please note that, if you do not want to enable Allow public client flows , you can create client_secret and give the parameter in Postman while generating the token
Now I created ROPC User flow like below:
I generated the access token using ROPC flow via Postman with parameters like below:
POST https://tenant.b2clogin.com/tenant.onmicrosoft.com/policy/oauth2/v2.0/token
grant_type: password
client_id: appid
scope: https://tenant.onmicrosoft.com/web_api/api.read
username: yourusername
password: *****
Response:
When I decoded the token, I can find the scp claim successfully like below:
