Using Azure App Services - Azure AD B2 - MobileServiceClient - authentication fails

Question

I have App Services set up to use Active Directory B2C for authentication and authorization. If I login directly via the url https://{myfunctionapp}.azurewebsites.com/.auth/login/aad, I get routed to the Sign-In/Sign-Up page and all seems to work well.

I have the following function defined being called by a link on a web page. When the function is called it returns 'Error: You do not have permission to view this directory or page.'

function callEmailLogin() {
    var functionAppBaseUrl = 'https://<myfunctionapp>.azurewebsites.com';
    var mobileClient = new WindowsAzure.MobileServiceClient(functionAppBaseUrl);

    mobileClient.login('aad', {'access_token': '<what goes here?>'})
    .done(function (results) {
         log('You are now logged in as: ' + results.userId);
         emailLink.innerText = 'Sign-out';   
    }, function (err) {
         log(err);
         emailLink.innerText = 'Sign-in/Sign-up';
    });
}

I followed Chris Gillum's post here to set-up ADB2C with App Services https://blogs.msdn.microsoft.com/appserviceteam/2016/06/22/app-service-auth-and-azure-ad-b2c/

I followed Stuart Leek's post here to create the simple web client, but there's no AAD example in the code, and it's not well https://blogs.msdn.microsoft.com/stuartleeks/2018/02/19/azure-functions-and-app-service-authentication/

I'm not sure what goes in the login call for 'access_token', I've assumed it is the Client Id set in the AAD Advanced settings which is the Application Id from the AD-B2C directory Application settings.

David Torres David Torres · Accepted Answer · 2018-05-31T14:09:11

I discovered my answers, I was making it way too hard.

I found that you don't need to send the access_token to the aad EasyAuth Provider. Modified as follows and it works!

function callEmailLogin() {
    mobileClient.login('aad')
    .done(function (results) {
         log('You are now logged in as: ' + results.userId);
         emailLink.innerText = 'Sign-out';
    }, function (err) {
         log(err);
         emailLink.innerText = 'Sign-in/Sign-up';
    });
}

With one issue, its not returning the Email Claim as "typ":"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", it is returning it as "typ":"emails". I just put a quick work around in to fix this issue, but does anyone know what the email claim is non-standard?

Using Azure App Services - Azure AD B2 - MobileServiceClient - authentication fails

1 Answers