We have a function, running in Azure App Service handling authenticated calls, via Easyauth for user accounts that are hosted in an Azure AD B2C tenant.
These accounts were previously self-served, via a B2C built-in SignUp&SignIn policy. We’re moving to an invitation only model and we’ve implemented a B2C SignIn_Only custom policy based on the Microsoft samples.
My question is specifically around App Service configuration. In the Authentication/Authorization settings, we have App Service authentication turned on for our function. The ‘Action to take when request is not authenticated’ is set to ‘Allow Anonymous requests (no action)’. The Azure Active Directory Provider is configured with the client ID of our function and the intended audience is set to our mobile app. The issuer URL is set to:
https://login.microsoftonline.com/{OurTenantName}/v2.0/.well-known/openid-configuration?p={OurBuiltinSignUpSignInPolicy}
With this configuration, requests from users signing in using the builtin policy work fine, but users signing in with the custom policy are returned 401 Unauthorized errors. Conversely, if we change the issuer URL to point to the new Signin_Only custom policy, requests from users signing in using the new policy work fine, but sign-ins using the builtin policy fail with the 401 errors.
I’ve tried this using both the login.microsoft.com and {ourtenant}.b2clogin.com endpoints with the same result. I’ve also inspected the JWT tokens and everything looks ok. Of course, the issuer is different but everything else including the signing keys looks right.
Is it possible to support users signing in via both builtin and custom policies? Many thanks.
