Acquire AAD B2C access token in webtest

0
votes

I have a REST API that is secured by AAD B2C access tokens. I now want to add webtests that can be used in load testing the API.

I am stumbling to acquire a valid access token for my test users from AAD B2C. I'm thinking to somehow get a token as a response from a REST API call to AAD B2C.

Looking in that direction on the net I have found a number of pages that point me to this rather undocumented endpoint 

https://{tenant}.b2clogin.com/{tenant}.onmicrosoft.com/oauth2/v2.0/token?p={policy}

where I need to provide a number of parameters. So far I found

  • client_id
  • client_secret
  • scope
  • grant_type

When I now add

  • grant_type=password
  • username
  • password

I thought when POSTing to that I would get a token from AAD - but I rather get a service side exception

{
    "error": "server_error",
    "error_description": "AADB2C: An exception has occurred.\r\nCorrelation ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\r\nTimestamp: 2018-11-07 16:27:10Z\r\n"
}

Questions

  • Is the approach correct?
  • Is there a better way to acquire an access token for a webtest?
  • Is the POST request malformed in any way?
1
azure-ad-b2crestful-authentication
Don't think you'll be able to mock being a user. The OAuth 2.0 spec for any user involved grant type requires user interaction to grant access as allowing random sites to create a UI to gather username/password and send them in would be a security hole. – Lee O.
You need to know a lot about the app, like client id and client secret - so just sending over random uid/pwd wont work. Despite - I think the /token endpoint is pretty much for this purpose … Alternatively - how would I go about getting a token non-interactrively?? – Stephan Hoffmann
OAuth does not assume the owner of the identity provider is also the owner of the consumer though. So someone could sign up for a client (gaining a client_id/client_secret/etc) and then gather the identity providers users private login info and send them over for authorization. But now that person could also log the users credentials and now impersonate them in any site that uses that identity provider. – Lee O.
docs.microsoft.com/en-us/azure/active-directory/develop/… is how you acquire an access token for things like an API to API call. – Lee O.

1 Answers

1
votes

You can create a resource owner policy that enables an access token to be acquired by the web test from the token endpoint using the password grant.