Search code examples
azureazure-ad-b2c

Access token not working Azure AD custom policy

I made a custom policy for Azure B2C, added jwt.ms as a reply URL and everything seems to be working fine. When I log in, I get redirected to jwt.ms showing the token and it's contents. However when I try to link my angular frontend to this custom policy, it does not seem to work. In need the response type id_token token, but when I use this response type I get the error "This application does not have sufficient permissions against this web resource to perform the operation."

When I use the response type id_token it seems to work fine and I get a reply with the JWT token.

I thought the problem might be in the Implicit grant settings under applications, so I have tried enabling Access tokens and ID tokens for all applications but this did not help.

Implicit grant settings

The request looks as follows:

https://{tenant}.b2clogin.com/{tenant}.onmicrosoft.com/oauth2/v2.0/authorize
?p=b2c_1a_signup_signin&client_id={client_id}
&redirect_uri=http%3A%2F%2Flocalhost%3A4200%2F&response_type=id_token%20token
&scope=openid%20https%3A%2F%2F{tenant}.onmicrosoft.com%2Fapi%2Fuser_impersonation
&nonce={nonce}
&state={state}

So if you replace the characters it looks like this:

https://{tenant}.b2clogin.com/{tenant}.onmicrosoft.com/oauth2/v2.0/authorize
?p=b2c_1a_signup_signin&client_id={client_id}
&redirect_uri=http://localhost:4200/&response_type=id_token token
&scope=openid https://{tenant}.onmicrosoft.com/api/user_impersonation
&nonce={nonce}
&state={state}

I expect the login flow to return both the JWT ID token and an access token.

Edit: I created a whole new B2C tenant with a standard Signupsignin user flow and I still experience the same issues. So I concluded that it is not a custom policy issue, but an issue caused by a configuration in Azure or the front-end application.

Solution

  • After a lot of experimenting, I understand your problem. I guess you are not trying in a right format. Even I don't know which document you are refereed to. Okay the first problem is...

    You are getting this error "This application does not have sufficient permissions against this web resource to perform the operation"

    Reason

    You have not set API access in your target application on azure portal. To achieve that you have add API access on your application.

    Let say you have two Published scopes on your B2C tenant application like below:

    enter image description here

    Create API Access

    To avoid above error Add API access. To do that , go to your application select API access after that you will see a Add button on top. click and right side API access window will be open just click Ok. See the below screen shot:

    enter image description here

    After successful API Access It should looks like below

    enter image description here

    Note: Hope it will solve your error while you are trying to send request.

    B2C id_token and Access Token

    Follow the below steps for Id_token

    ID Token Access Process

    https://YourB2CTenant.b2clogin.com/tfp/YourB2CTenant.onmicrosoft.com/YourPolicy/oauth2/v2.0/authorize?

    client_id= YourApplicationId

    &redirect_uri= Your reply from Application

    &scope=openid

    &response_type=id_token

    Take a look below at Id_token:

    enter image description here

    Note: Just fill out the above format and paste at your browser with no space between. If is it correct then a sign in page will be prompted. After sign in you will be given id_token on your browser.

    B2C Access Token

    Follow the below format In POSTMAN:

    Grant Type:authorization_code

    Callback URL: Your Reply URL

    AuthURL:https://YourTenant.b2clogin.com/YourTenant.onmicrosoft.com/YourFlow/PolicyName/oauth2/v2.0/authorize?

    Access Token URL: https://YourTenant.b2clogin.com/YourTenant.onmicrosoft.com/oauth2/v2.0/token?p=YourFlow/PolicyName

    Client ID: Your Application Id

    Client Secret = Application Key

    Scope= any of your Published scopes

    Postman request process

    Go to postman and click on Authorization Tab and Select type as OAuth 2.0 See the below screen shot:

    enter image description here

    For getting access token click on Get New Access Token You will be prompt following window fill out it with above mentioned format.

    enter image description here

    enter image description here

    After hitting Request Token button you will be prompted a sign in window after successful login you will get access_token in response. Like below:

    enter image description here

    Note: In B2C there is no supported way to get `Id-Token and access_token together in a single request. You have to achieve it in separate request. For more details you could refer here.