i am currently implementing a "System-of-Systems" authentication architecture in Azure Active Directory B2C (AAD B2C). In these scenario there is an initial SSO application that redirects the user to a general dashboard. The dashboard should enable the user to use additional services (service applications). (For example a tile view)
To use these additional services, the user must grant explicit permission for each external service. With this delegated permissions, the user authorizes the service to access certain data (for example, IoT data or personal data).
These AAD B2C application is characterized in this scenario by a client and backend application (api) (for each service). The client application contains scopes (delegated permissions) from the backend application, which are stored as a JWT validation - Policy in each Azure API Management endpoint.
Authentication against these assigned backend scopes already works with the Microsoft Login Provider (Identity Provider), but not with the local Identity Provider (for E-Mail).
Here: My Scenario
I changed the access level from Admin to User in the application manifest: (Here)
Microsoft Access Panel (works here)
My Problem the Local Idenitity Access Panel for users (that doesn't works) -> should look like this: Microsoft Docs (consent dialog)
For the following request:
https://[tenant].b2clogin.com/[tenant].onmicrosoft.com/oauth2/v2.0/authorize?p=B2C_1_SignUpAndSignIn&client_id=xxxxx-xxx-xxxxxx&nonce=defaultNonce&redirect_uri=https%3A%2F%2Fjwt.ms&scope=openid https://[tenant].onmicrosoft.com/backend/Backend.Read&response_type=id_token token&prompt=login
... I always get the following error message:
AADB2C90205: This application does not have sufficient permissions against this web resource to perform the operation.
The approval framework is not displayed for the user, therefore the request is rejected by insufficient permissions.
Do you know how to solve this problem? Are there any walkarounds or configuration options?
Thank u & Best regards
