Search code examples
reactjsazureasp.net-core-webapiazure-ad-b2cmulti-tenant

Allow APIs in azure multi-tenant ADB2C to be consume by another tenant client app

I am working on .net web api and reacts app projects and registered in azure different tenant; Azure Active Directory B2C (ADB2C)

Tenant A: Web API project

Tenant B: React Client App1 (this need to consume APIs from Tenant A)

Tenant C: React Client App2 (this need to consume APIs from Tenant A)

I am unable to see APIs in Tenant B / C under API Permission and stuck over here..

In Tenant A: I have scope

https://MyMachine.onmicrosoft.com/api/xxx/Core.API.All

and then under Tenant A; API Permission --> I added 'Application Permission' for APIs

In Manifest I can see

"signInAudience": "AzureADMultipleOrgs",

enter image description here

I have same owner in all tenants

what else i need to do to have API from Tenant A to be accessible on tenant B and C

i have created consent url which ask me to authorise but i still not able to see Core.API.All in tenant B/C under API Permission

https://login.microsoftonline.com/{TenantA TenantID}/adminconsent?client_id={TenantB : ClientID}&redirect_uri=http://localhost:3000/auth-callback

enter image description here

enter image description here

Solution

  • In B2C TenantA, I created a Multitenant application and exposed an API, added scope:

    enter image description here

    Granted API permissions:

    enter image description here

    To get this TenantA as Enterprise application in TenantB, run the below and sign in with TenantB user:

    https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=TenantAWebProjecttAppID&response_type=code&redirect_uri=https://jwt.ms&response_mode=fragment&scope=https://b2caadtenant.onmicrosoft.com/xxx/Core.API.All&state=12345

    enter image description here

    An Enterprise application will be created in TenantB. To grant the API permissions to the Enterprise application in TenantB, run the below and sign in TenantB user:

    https://login.microsoftonline.com/organizations/adminconsent?client_id=TenantAWebProjecttAppID

    enter image description here

    In TenantB, the Enterprise application now has permissions granted:

    enter image description here

    Now create the application in TenantB and add the API permission of TenantAWebProjectt like below:

    enter image description here

    Now TenantB client app will be able to consume APIs from TenantA and do the same with TenantC.