Cancelling new user signup in Azure AD B2C redirects to sites home page, produces "AuthorizationFailed" error

user_2631623 0
Viewed 680

I have a Blazor Hosted WASM application, and am using Azure AD-B2C to secure it. If a user who is not logged in tries to access any site on the page, they are directed to our b2c login page, as they should be, and if they supply a good username and password they are allowed to view the site. So far so good. However, if the user clicks on "Sign up now", and then cancels the signup process instead of providing a new username, password, and e-mail address, then they are redirected to the site's landing page (as if they had provided a good username and password), which fails to redirect them back to the b2c login page and produces a console message reading "info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[2] Authorization failed. These requirements were not met: DenyAnonymousAuthorizationRequirement: Requires an authenticated user"

The documentation suggests that I access the app's manifest and set the allowPublicClient attribute to null or true to address this problem. I have done this, and the problem persists. Why isn't the user being redirected back to the B2C login page in this case, when they normally would be if they try to access any page on the site (including this landing page) in other cases?

azure-ad-b2c blazor asp.net-core azure
1 Answers

When the user cancels and get redirected back to the landing page, it returns an specific error code in the url (eg: AADB2C90118) in the return redirect url (In some cases it only flashes quickly because Angular removes the query string after the redirect).

You need to listen to this and handle it. You can handle it manually by parsing the return url but if you use msal.js on client side you can listen to this and start the reset password flow.

this.broadcastService.subscribe("msal:loginFailure", (error) => {
  console.warn("msal:loginFailure", error);
  // Check for forgot password error
  // Learn more about AAD error codes at https://docs.microsoft.com/en-us/azure/active-directory/develop/reference-aadsts-error-codes
  if (error.errorMessage.indexOf("AADB2C90118") > -1) {
    alreadyRedirecting = true;
    this.msalAuthService.loginRedirect(
      b2cPolicies.authorities.resetPassword
    );
  }
});

The above example is for when the user clicks on forgot password link and get redirected back, so you will need to find the error code that applies to you.

user_16023160
Related