Azure App Service Easy Auth with Client Credentials Grant flow in AAD B2C

问题

Is it possible to secure a Web API in an App Service within Azure, using the built in Authentication/Authorization options and at the same time access it using the OAuth Client Credential Grant flow?

I have an app service being authenticated with Azure AD B2C. In that B2C tenant I have the web app/API registered and authentication working fine for using the web app. I added a scope in the Published Scopes section of that AD B2C app and also added an App ID URI for that scope. Then I created another App (ClientApp) in the tenant to represent another service I want to provide access to the first API. I generated a Secret key for it and also in the API access section added the scope I had created in the other app.

Then in postman I get the token using the next

Grant type: Client credentials
Access token URL: https://login.microsoftonline.com/mytenantname.onmicrosoft.com/oauth2/v2.0/token (for some reason I have to use login.microsoftonline as the b2clogin domain doesn't work for this)
Client ID: The ID that appears in the app registered for the ClientApp
Client secret: The secret generated under the ClientApp
Scope: the App ID URI I added the the web app registration.

I successfully get the token, but when I try to access the web site using the bearer token with postman, I just get a 401.

回答1:

It is not supported to use client_credentials flow against AAD B2C application registrations. Therefore you have to instead create an App Registration through the normal Azure AD Blade instead.
https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-apps#current-limitations

Then the App Service must accept tokens from 2 different authorities, which App Services cannot do with EasyAuth (Authentication enabled at the App Service configuration menu).

You would instead need to use a library that can accept tokens from multiple authorities. There is an example here:
Use multiple JWT Bearer Authentication

回答2:

I've spent hours to find a proper solution.

This solution: https://stackoverflow.com/a/48657826/11721142 doesn't work with mine B2C setup (is almost ideal :) ). I had to change original:

"additionalLoginParams": [
  "response_type=code id_token",
  "resource=<AAD-app-id-for-your-webapi-webapp>"
]

To:

"additionalLoginParams": [
  "scope="scope=https://xxx.onmicrosoft.com/{Guid}/all+openid+offline_access""
]

Where

https://xxx.onmicrosoft.com/{Guid}/all is your scope identifier defined in B2C API permisions

Then... finally I can call {frontend-app-domain}/.auth/login/aad and... see: access-token, id-token and refresh-token after {frontend-app-domain}/.auth/me

You can also provide required scopes like that: {frontend-app-domain}/.auth/login/aad?scope=<see scopes above>

回答3:

Not sure if I understand it correctly, but it seems you are using a URL as scope. It works if you set the scope to the application id of the app service (you can find an enterprise application with the name of your app service in azure AD) instead of using the URL. (format: /.default)

I am still trying to figure out if it is possible to use the URL as scope...

来源：https://stackoverflow.com/questions/53786852/azure-app-service-easy-auth-with-client-credentials-grant-flow-in-aad-b2c

标签

azure

azure-ad-b2c