Geek Answers Handbook

Problem with Azure AD B2C oauth / OpenIdConnect

I have a weird problem with azure authentication. It works in one scenario (logging in with an angular application using adal), but not in another (loading asp.net web api up and logging in through the swagger ui authorization mechanism). I narrowed it to a post:

https://login.microsoftonline.com/te/{tenantid}/oauth2/authresp

which pretty uselessly returns:

302

<html>
 <head>
  <title>Object moved</title></head>
  <body>
   <h2>Object moved to <a href="http://localhost:49919/swagger/ui/oauth2redirect-html#error=server_error&amp;error_description=AADB2C%3a+An+exception+has+occured.%0d%0aCorrelation+ID%3a+1816d2f8-aa74-4433-a7c0-d9c8fabebdb0%0d%0aTimestamp%3a+2017-10-27+13%3a46%3a08Z%0d%0a&amp;state={ommitted}">here</a>.</h2>
</body>
</html>

Basically speaking, an exception occurred.

error_description = AADB2C An exception has occurred.

CorrelationID = 1816d2f8-aa74-4433-a7c0-d9c8fabebdb0

Timestamp = 2017-10-27 13:46:08

The angular app does exactly the same thing, but nonetheless returns a link with the token id:

302

<html>
  <head>
   <title>Object moved</title>
  </head>
  <body>
   <h2>Object moved to <a href="http://localhost:4200/#state={state -
   ommitted}&amp;id_token={id token - omitted}">here</a>.
    </h2>
   </body>
 </html>

I do not see differences in the messages. This does not work (initiated with swagger ui in web api project)

POST https://login.microsoftonline.com/te/{tenant - omitted}/oauth2/authresp HTTP/1.1
Host: login.microsoftonline.com
Connection: keep-alive
Content-Length: 1595
Cache-Control: max-age=0
Origin: https://login.microsoftonline.com
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.62 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
DNT: 1
Referer: https://login.microsoftonline.com/{tenant - omitted}/oauth2/authorize?client_id={clientid - omitted}&redirect_uri=https:%2f%2flogin.microsoftonline.com%2fte%2f{tenant - omitted}%2foauth2%2fauthresp&response_type=id_token&response_mode=form_post&nonce={nonce}&state=StateProperties
Accept-Encoding: gzip, deflate, br
Accept-Language: en-GB,en;q=0.9,de-CH;q=0.8,de;q=0.7,fr-CH;q=0.6,fr;q=0.5,it-CH;q=0.4,it;q=0.3
Cookie: {cookie - omitted}=; x-ms-gateway-slice=005; stsservicecookie=cpim_te

id_token={omitted}

But this message:

POST https://login.microsoftonline.com/te/{tenant - omitted}/oauth2/authresp HTTP/1.1
Host: login.microsoftonline.com
Connection: keep-alive
Content-Length: 1590
Cache-Control: max-age=0
Origin: https://login.microsoftonline.com
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.62 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
DNT: 1
Referer: https://login.microsoftonline.com/{tenant - omitted}/oauth2/authorize?client_id={clientid - omitted}&redirect_uri=https:%2f%2flogin.microsoftonline.com%2fte%2f{tenant - omitted}%2foauth2%2fauthresp&response_type=id_token&response_mode=form_post&nonce={nonce}&state=StateProperties
Accept-Encoding: gzip, deflate, br
Accept-Language: en-GB,en;q=0.9,de-CH;q=0.8,de;q=0.7,fr-CH;q=0.6,fr;q=0.5,it-CH;q=0.4,it;q=0.3
Cookie: {cookie - omitted}; x-ms-gateway-slice=003; stsservicecookie=cpim_te

id_token={omitted}

, - id ( ). ID http://www.jwt.io ​​ , . , , - ?

+6
1

, , /v 2.0/B2C. , /{tenant}/oauth2/ v2.0/authorize...

https://login.microsoftonline.com/{tenant}/oauth2/authorize?client_id={clientid}&redirect_uri=https:%2f%2flogin.microsoftonline.com%2fte%2f{tenant}%2foauth2%2fauthresp&response_type=id_token&response_mode=form_post&nonce={nonce}&state=StateProperties

- . , , , B2C ( ).

B2C ONLY , B2C. , B2C , .

+1

More articles:


All Articles