MSAL Client Credential with AAD B2C

user_8497353 0
Viewed 1020

I want to allow users of a B2C-secured app to browse before deciding to register

To that end, I need to embed a Client Credential flow within my app

I have only been able to find examples dealing with Graph API, which is an invalid token for an API secured within my AAD

Would someone be able to modify the example below to indicate what the Client Credential Paramaters would look like below in respect of b2clogin in order to pass it an app ID, and secret, and return a token which can be used to authorise calls to the API?

Edit: this is what I am now passing to try and get a token I can use

    public static string tenantID = "aadtenant.onmicrosoft.com";
    public static string ClientID = "xxxx-a2e2-40f5-958b-dc39ca2bd413";
    public static string Secret = "zzzzzzzzs_JhPY1HSFEREgRy5Z2rcL";
    public static string redirectURI = "https://mysite.azurewebsites.net/api";
    public static string[] scopes = new string[] { "api://xxxxxx-a2e2-40f5-958b-dc39ca2bd413/.default" };
    public static string url = String.Format("https://login.microsoftonline.com/{0}/oauth2/v2.0/token", tenantID);

However this returns a failure

Exception AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials.

The one thing I have noticed is that when I set up API access in my AAD tenant app, only Graph is assigned. When I go to My APIs, I am not seeing anything. So I am not sure how exactly the AAD app and the B2C app relate to each other

Another edit: I have now granted a permission from the AAD app to the B2C app and created a scope but I am still getting an error, this time that the scope isn't valid

msal azure-ad-b2c
1 Answers

The last time I implemented client credentials authentication to an API where B2C was used, I essentially had to add a second authentication scheme to the API. I registered an app in the underlying Azure AD of the B2C tenant, registered an application permission there (appRole), and then that can be assigned to client apps (that also need to be registered in the underlying AAD tenant).

Then the API needs to be able to validate both access tokens coming in with scopes from the B2C registration, or with app permissions (roles) from the AAD registration. The issuers etc. are different in those tokens.

It is a bit painful frankly, but this is essentially what the docs recommend: https://docs.microsoft.com/en-us/azure/active-directory-b2c/application-types#daemonsserver-side-applications.

Although client credential flow is not currently supported by Azure AD B2C, you can set up client credential flow using Azure AD. An Azure AD B2C tenant shares some functionality with Azure AD enterprise tenants. The client credential flow is supported using the Azure AD functionality of the Azure AD B2C tenant.

Once you have all that setup, your client needs to use the AAD registration client id + secret, with the scope set to api-client-id/.default.

user_16589060
Related