Azure B2C Implicit Flow for SPA using Auth API gives invalid token for openid scope

3
votes

I have setup my application to use Azure B2C's Implicit Flow token strategy to give me tokens via the post-signup/signin login in the URI. This works fine and the tokens authorize without a hitch.

However, the client is an SPA, so when the token expires, the documented workaround suggested by Microsoft is to use an iframe that makes a call to the authorize endpoint as documented here: Get Access Tokens

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize?client_id={my_client_id}&response_type=token&redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F&scope=openid&response_mode=fragment&state=12345&nonce=678910&prompt=none&domain_hint=organizations&[email protected]

Unfortunately if I request an id_token using the openid scope with this endpoint, the token that's actually returned does not authorize via B2C in my API. Examining the JWT token in a decoder also shows that the token itself looks different than the one given post-signin from B2C.

I realize this documentation is for Azure Active Directory and that B2C doesn't support SPAs at this point, but I had heard from Microsoft representatives previously that this should work.

Is this really not supported yet? And if not, are there any workarounds for SPAs?

1
azureoauth-2.0single-page-applicationazure-active-directoryazure-ad-b2c
There is a similar post her: stackoverflow.com/questions/33975012/… - Alain Croisetière
I've already seen that post. This question is not about ADAL, it's about the token endpoint. I'm not developing the SPA itself so have no control over it. - starmandeluxe
Can you give more details on how you secure your api? - Alain Croisetière
As of November 28 2016 this functionality is available. See this: feedback.azure.com/forums/169401-azure-active-directory/… - user1843640
@user1843640 see my comment below. It was on November 29, not 28. - starmandeluxe

1 Answers

2
votes

Many modern apps have a single-page app front end written primarily in JavaScript. They often use a framework such as AngularJS, Ember.js, or Durandal. The generally available Azure AD service supports these apps by using the OAuth 2.0 implicit flow. However, this flow is not yet available in Azure AD B2C.

This feature is not support yet as the document stated at present. If you want Azure AD B2C to support this feature, you can vote it from here.