Client Credentials flow with AAD B2C

Question

I have a SPA React app with a NetCore API backend. This api is also used by another application.

I want to authenticate and authorize the SPA users using AAD B2C and the second app using the client credential flow. I understand that client credential flow is not supported by B2C. And I read that to achieve that I'd need to register the api again in Active Directory (non-B2C) as well as the client app and configure that using normal AD.

That will leave me with SPA and API registered as apps in B2C and API and client app in normal non-B2C.

IF.... all that is correct, how do I make the API validate both different types of clients? Authorizing users from B2C and client app through client credentials flow against AD non-B2C

Answer 1

For authorizing users from B2C, you just need to refer to this document: Tutorial: Grant access to an ASP.NET web API using Azure Active Directory B2C.

Your main concerns is for client credentials flow against AD non-B2C.

I have a test and the steps are the same as in the normal AD:

I registered a web API application in Azure AD B2C. Add an appRole in its manifest.xml.

"appRoles": [
        {
            "allowedMemberTypes": [
                "Application"
            ],
            "description": "Writers Have the ability to create tasks.",
            "displayName": "Writer",
            "id": "d1c2ade8-98f8-45fd-aa4a-6d06b947c66f",
            "isEnabled": true,
            "lang": null,
            "origin": "Application",
            "value": "Writer"
        }
    ]

Then I registered a web App application in normal AD. Add the API permission to it.

Use client credentials flow to acquire the access token.