I am trying to run the WebApp B2C sample:
https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/tree/master/1-WebApp-OIDC/1-5-B2C
When I try to login, I get the following error:
IDX40002: Microsoft.IdentityModel does not support a B2C issuer with 'tfp' in the URI. See https://aka.ms/ms-id-web/b2c-issuer for details.
If I edit the Instance to https://myHost.b2clogin.com I get:
AADSTS50011: The redirect URI 'https://myHost.b2clogin.com/1c2009bb-7e35-4a0e-9f22-xxxxxxxxx/oauth2/authresp' specified in the request does not match the redirect URIs configured for the application 'c24b0337-0bd9-45ee-8376-xxxxxxxxx'. Make sure the redirect URI sent in the request matches one added to your application in the Azure portal. Navigate to https://aka.ms/redirectUriMismatchError to learn more about how to fix this.
Edit:
These are my redirects:
I tried to reproduce the same in my environment and got the below results:
I deployed custom policy starter pack via IEF Setup App by entering my Azure B2C tenant name like below:
When I checked that in Portal, custom policies are created successfully like below:
Now I registered one Azure AD B2C app named webapp1 as below:
I added redirect Uri to the above application like below: https://localhost:44316/signin-oidc
Now, I followed the same link that you mentioned and deployed one sample B2C web application by modifying appsettings.json file like below:
"AzureAdB2C": {
"Instance": "https://sridevib2c.b2clogin.com",
"ClientId": "9986e76d-bxx7-4x6x-bxx7-3d8xxxxx9a45",
"Domain": "sridevib2c.onmicrosoft.com",
"SignedOutCallbackPath": "/signout/B2C_1A_SIGNUP_SIGNIN",
"SignUpSignInPolicyId": "B2C_1A_SIGNUP_SIGNIN",
"ResetPasswordPolicyId": "B2C_1A_PASSWORDRESET",
"EditProfilePolicyId": "B2C_1A_PROFILEEDIT" // Optional profile editing policy
//"CallbackPath": "/signin/B2C_1A_SIGNUP_SIGNIN" // defaults to /signin-oidc
},
JSON file:
When I ran the above web application, it took me to below web page:
After selecting Sign Up/In, I got the login screen like below:
When I entered my credentials, I logged in to the application successfully like below:
When I clicked on Sign Out, it showed me below screen by signing me out:
After a long research I found this article/sample, where the Microsoft.Identity.UI framework is replaced with the Microsoft.AspNetCore.Authentication.AzureADB2C.UI.
However, with the https://myDomain.b2clogin.com url I still get the same error, using the custom domain it works, that's enough for me.
Related
I am trying to sign up the users using Azure B2C(by doing this I am using MSAL with Angular),
by mail confirmation, captcha v2(google) and MFA.
For the first attempt I used just a normal sign up with the email and afterwards with MFA and had no issues creating the users.
Than I added captcha and in my sign-up, meaning that I needed to use a custom page.
To add captcha feature I used the following process from this link Link - Create Captcha with Azure B2C (regarding one step that is described in the article, the azure function was created in the portal, because locally I had some issues)
In my sign up page where you add the email address and all the claims of the user, after adding all the claims and checked the captcha feature, than press for create, appears the following message:
errorCode: "AADB2C90261" message: "The claims exchange
'PreUserWriteRestful' specified in step '1' returned HTTP error
response that could not be parsed." status: "400"
AADB2C90261 -Taken from Microsoft page - Error Code - The claims exchange '{0}' specified in step '{1}' returned HTTP error response that could not be parsed.
Also the MFA feature doesn't appear. What can be ? that I missed to do ? Or what it represents ?
Tested without MFA and the same issue persists
Did anybody that is using Azure B2C added captcha ?
Thank you.
I tried to reproduce the same in my environment and got below results:
Initially I deployed Azure Function via Portal and left index.js file as default like below:
I configured one API connector named Verify Captcha by adding above function URL in endpoint like below:
Now I added this API connector to my user flow like below:
When I ran the user flow by entering required details in Sign up page and checked the captcha feature, I got the same error as below:
To resolve the error, I tried deploying 2 Http Trigger Functions locally:
HttpTrigger1 - modified index.js file with this GitHub code
and installed required modules like below:
HttpTrigger2 - left index.js file with default code like below:
By updating properties in local.settings.json file, I deployed these functions to Azure:
{
"IsEncrypted": false,
"Values": {
"AzureWebJobsStorage": "",
"FUNCTIONS_WORKER_RUNTIME": "node",
"BASIC_AUTH_USERNAME": "xxxxx",
"BASIC_AUTH_PASSWORD": "xxxxx",
"CAPTCHA_SECRET_KEY": "6LfoQ9oxxxxx21BEE23-kPQkv6QIQt8",
"B2C_EXTENSIONS_APP_ID": "dcxxx0b0-d5xf-42x-b1a4-97xxx689x1"
}
}
Response:
When I checked in Azure Portal, functions are updated successfully like below:
I configured another API connector named Verify Captcha server side by adding above function URL in endpoint like below:
Now I updated API connector with above in my user flow like below:
I ran the user flow by entering required details in Sign up page and checked the captcha feature like below:
When I selected Create account, I got response like below:
It may take some time to complete the captcha like below:
When I tried the same with default index.js like HttpTrigger2, I'm getting same error as you. So, make sure to replace code in your index.js file with this GitHub code.
You can try the same in your environment locally to resolve the issue.
I've built a basic Vue web app using Azure Static Web Apps, and I'm trying to configure custom authentication. I've already managed to get everything (mostly) working using Auth0 by following the documentation and referencing this handy blog post.
For Auth0, I added AUTH0_ID=<my-auth0-id> and AUTH0_SECRET=<my-auth0-secret> to the local.settings.json file. My staticwebapp.config.json looked like this:
...
"auth": {
"identityProviders": {
"customOpenIdConnectProviders": {
"auth0": {
"registration": {
"clientIdSettingName": "AUTH0_ID",
"clientCredential": {
"clientSecretSettingName": "AUTH0_SECRET"
},
"openIdConnectConfiguration": {
"wellKnownOpenIdConfiguration": "https://<my-auth0-tenant>/.well-known/openid-configuration"
}
},
"login": {
"nameClaimType": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
"scopes": ["openid", "profile"]
}
}
}
}
}
I'm now trying to set up authentication using Azure AD B2C. My understanding is that Azure Static Web Apps handles a portion of the authentication such that I should configure the ID provider to work with a web app rather than with a single page app framework. This is what I did when using Auth0 and it seemed to work.
I've added AADB2C_ID=<my-azure-ad-b2c-id> and AADB2C_SECRET=<my-azure-ad-b2c-secret> to the local.settings.json file. In staticwebapp.config.json I replaced ClientIdSettingName to AADB2C_ID, clientSecretSettingName to AADB2C_SECRET, and wellKnownOpenIdConfiguration to https://<my-azure-ad-b2>.b2clogin.com/<my-azure-ad-b2c>.onmicrosoft.com/v2.0/.well-known/openid-configuration?p=B2C_1_signupsignin1. This references the 'signupsignin' user flow on my B2C tenant.
At this point I can visit /login which points to /.auth/login/aadb2c, initiates the user flow, and lets me sign up and verify as expected. The test user is then created in my Azure AD B2C tenant. However, B2C then tries to redirect me to /.auth/complete which throws a 403 error:
We need an email address or a handle from your login service. To use
this login, please update your account with the missing info.
I've tried adding /.auth/complete as an allowed redirect URI in Azure AD B2C but this doesn't fix things. What am I missing here?
Try changing to this: "nameClaimType": "emails".
Sourced from staticwebapp.config.json in here: https://github.com/Azure/static-web-apps/issues/457
I am following azure AD B2C auth example which runs fine on local changing appsettings.json to my webapp tenant/app. When I publish to azure the home webpage opens but at pressing Login I don't get to the authorisation window, Fiddler shows:
redirect_uri_mismatch
AADB2C90006: The redirect URI
'https://webappname.azurewebsites.net/signin/B2C_1_mysigninoutpolicy' provided in the request is not registered for the client id 'xxxxxxxx'.
The user flow policies are registered:
I think this setup is b2login.com compliant.
a) I create tenant and register the app in portal. At the tenant:
Azure AD B2C resource name (tenant): tenantName.onmicrosoft.com
I set App Registration->Reply URL https://webappname.azurewebsites.net/signin-oidc
Also on App Registration->Add ID URI (optional): I left it blank
Native client: No
b) At my subscription level (not tenant) Azure portal, the published app settings:
app URL: https://webappname.azurewebsites.net
Configuration->Application settings: shows WEBSITE_NODE_DEFAULT_VERSION and I've added ASPNETCORE_ENVIRONMENT with value "Production".
At the project's appsettings.json, settings are:
"Instance": "https://tenantName.b2clogin.com",
"ClientId": "XXXXXX",
"ClientSecret": "XXXXX",
"Domain": "tenantName.onmicrosoft.com",
"SignedOutCallbackPath": "/signout/B2C_1_mysigninoutpolicy",
"SignUpSignInPolicyId": "B2C_1_mysigninoutpolicy",
"ResetPasswordPolicyId": "B2C_1_myresetpolicy",
"EditProfilePolicyId": "B2C_1_myeditprofilepolicy", // Optional profile editing policy
"CallbackPath": "/signin/B2C_1_mysigninoutpolicy"
The example does't use "Tenant" so I left it out?
I tried uncommenting the example's Callbackpath but same error:
//"CallbackPath": "/signin/B2C_1_sign_up_in" // defaults to /signin-oidc
I restarted the web app and waited a couple of minutes each time I've tested. I browse to test at https://webappname.azurewebsites.net
Thank you for your help
The redirect URI in the application registration must match the callback path in the application configuration.
In the above question, the redirect URI is set to /signin-oidc but the callback path is set to /signin/B2C_1_mysigninoutpolicy, which results in the redirect_uri_mismatch error response.
We have the following Azure AD B2C Application (which we will call aadb2c) with the following settings
Include web app/ web API: YES
Allow Implicit Flow: YES
Reply Url:
- https://localhost:44339/
- https://productionURL.com
- https://productionURL.com/
App ID URI (which is optional): none
Native CLient: NO
This Application is what our website https://productionURL.com uses to login it's users with azure AD B2C.
However, on production we keep on getting the error:
The redirect URI 'productionURL.com' provided in the request is not registered for the client id 'aadb2c'
According to this we should add the link to out reply url.
But as you can see above, we already included https://productionURL.com in the "Reply URL" section
of the Azure AD B2C blade.
What could be causing this error to happen? How do we resolve the redirect URI request not registered error?
It needs to be configured in the code as well and you need to make sure that the protocols match. This can also happen if there's a mismatch with the tenant ID or the app ID.
Check the B2C callback request in Chrome DevTools > Network with "Preserve log" to see what URL is being returned. This should give you insight into the problem.
As an extra measure to ensure that the protocols are matching, you can add:
if (context.ProtocolMessage.RedirectUri.Contains("http:"))
{
context.ProtocolMessage.RedirectUri = context.ProtocolMessage.RedirectUri.Replace("http:", "https:");
}
After hours looking at our code and finding no traces of the url without any protocol or any trace of "http:", we now had to look at our deployment orchestrator.
Apparently in Octopus we are deploying the app with an incorrect URI: it's missing the protocol "https://"
I've been following the guide in this repo to setup a resource token provider as an Azure function.
https://github.com/adamhockemeyer/Azure-Functions---CosmosDB-ResourceToken-Broker
I've setup the Cosmos DB, App registration, and Azure function with permissions according to the instructions. When I get to step 3 in the guide where I enter https://{function-url}/.auth/login/{provider} into my browser I get the following error.
ADSTS50011: The reply url specified in the request does not match the
reply urls configured for the application: [App id]
Update
I changed the Reply URL in my App Registration to https://{function-url}/.auth/login/{provider}/callback with {function-url} as my Function App URL. Originally I had it set to one of my Function URL's. Now i'm getting a 404 not found error.
App Registration Redirect URL
Function App URL
Function App Authentication Settings
You need to add the URL as below in your app registration, then it should work.
Note: After adding the URl, go back to the Authentication / Authorization in your functionapp, turn off the Authentication Providers whcih you configured -> turn off Authentication / Authorization, then turn on and configure again, otherwise it seems not become effective.
https://{function-url}/.auth/login/{provider}/callback
Update:
Turn off all the configuration and create the new AD App like below.