B2C OpenId Connect jwt Token Validation in web api

Question

I've been struggling with this token validation and the Microsoft documentation didn't offer any kind of help. I'm using B2C with identity provider, I am using angular frontend and asp.net core api as backend. I am able to login using b2c and the user is being validated and i'm getting the following claim:

{
"homeAccountId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx-b2c_1_susi.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"environment": "xxxxxxxxxxxx.b2clogin.com",
"tenantId": "",
"username": "jad.fakhoury@xxxxxxxxx.com",
"localAccountId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"name": "Jad Fakhoury",
"idTokenClaims": {
    "exp": 1662892072,
    "nbf": 1662888472,
    "ver": "1.0",
    "iss": "https://xxxxxxxxxxxxxxxxxxxxxxxx.b2clogin.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/v2.0/",
    "sub": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "aud": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "nonce": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "iat": 1662888472,
    "auth_time": 1662888471,
    "idp_access_token": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "idp": "https://login.microsoftonline.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/v2.0",
    "name": "Jad Fakhoury",
    "oid": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "given_name": "Jad",
    "family_name": "Fakhoury",
    "emails": [
        "jad.fakhoury@xxxxxxx.com"
    ],
    "jobTitle": "Admin",
    "extension_Discount": "3.70",
    "tfp": "B2C_1_susi"
}

I send the idp_access_token to the api but i am unable to validate it, the user always has IsAuthenticated = false.

I'm using :

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                .AddMicrosoftIdentityWebApp(builder.Configuration);

in my program.cs, and in my appsettings.json i have used different combinations of instance, ClientId, TenantId... but my token is never validated. could anyone points out what am I doing wrong or what fields from the tokenClaims i should use to validate?

NB: I am able to decode the token in code and i can see the data but i am unable to validate it to use it in my controller.

Tore Nestenius · Answer

To debug your problem you can:

Enable the following flag:

.AddJwtBearer(opt => {
... opt.IncludeErrorDetails = true; ... };

It will include an extra reader in the response that can give you a hint about the reason why it failed.

Like this example:

HTTP/1.1 401 Unauthorized
Date: Sun, 02 Aug 2020 11:19:06 GMT
WWW-Authenticate: Bearer error="invalid_token", error_description="The signature is invalid"

You can increase the log level from authentication and authorization using these settings in appsettings.json:

{ "Logging": { "LogLevel": { "Default": "Warning", "Microsoft": "Warning", "Microsoft.Hosting.Lifetime": "Information", "Microsoft.AspNetCore.Authentication": "Debug", "Microsoft.AspNetCore.Authorization": "Debug" } } }

B2C OpenId Connect jwt Token Validation in web api

1 Answers