I've been asked to integrate a new web app with our B2C implementation and the requirement is to support the Grant Flow with PKCE.
Does B2C/IEF support this? Any pointers as to steps required?
I'm hopeful as I've found this reference in the AD docs, which references code_challenge and code_challenge_method parameters in the request to the /authorize endpoint.
Thanks Mark
According to this developer announcement and this documentation issue, it is supported, although it isn't enabled for the implicit flow AFAIK.
it sounds like you are trying to create a web based application that can only use Auth code with PKCE per the new OAuth guidelines. Please refer to the following post in regards to the new OAuth rules and Microsoft's Auth process : https://developer.microsoft.com/en-us/identity/blogs/our-thoughts-on-implicit-grant-with-microsoft-identity/
Microsoft's suggestion is to utilize the Microsoft Libraries to do authentication, that is using either ADAL/MSAL.
As it's a B2C Application you will want to use MSAL. For more information on using MSAL please refer to : https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-b2c-overview
