Azure AD B2C Web API Using .NET Core 2

Question

I’m trying to call a Web API from a Web App both protected by Azure AD B2C. The App signs in fine with the Azure sign in page. But when I call my [Authorize] endpoint on my API I get a 401 unauthorized response.

I thought this is supposed to work right out of the box using VS2017 and ASP.NET Core 2.1. When I created both apps I specified “Individual User Accounts” for authentication and “Connect to an existing user store in the cloud”. The examples I’ve found seem to be from .NET Core 1 or older and no longer relevant or using deprecated setups.

I have the App in the API access section with read and write scopes in Azure.

How do I successfully authorize my App to call my API?

Here’s my App Startup.cs:

public void ConfigureServices(IServiceCollection services)
{
    services.Configure<CookiePolicyOptions>(options =>
    {
        // This lambda determines whether user consent for non-essential cookies is needed for a given request.
        options.CheckConsentNeeded = context => true;
        options.MinimumSameSitePolicy = SameSiteMode.None;
    });

    services.AddAuthentication(AzureADB2CDefaults.AuthenticationScheme)
        .AddAzureADB2C(options => Configuration.Bind("AzureAdB2C", options));

    services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
}

// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }
    else
    {
        app.UseExceptionHandler("/Home/Error");
        app.UseHsts();
    }

    app.UseHttpsRedirection();
    app.UseStaticFiles();
    app.UseCookiePolicy();

    app.UseAuthentication();

    app.UseMvc(routes =>
    {
        routes.MapRoute(
            name: "default",
            template: "{controller=Home}/{action=Index}/{id?}");
    });
}

My App appsettings.json:

{
  "AzureAdB2C": {
    "Instance": "https://myCompanyPassport.b2clogin.com/tfp/",
    "ClientId": "51dde0de-a204-4b67-b890-068846e17ff1",
    "ClientSecret": "------------------------",
    "CallbackPath": "/signin-oidc",
    "Domain": "myCompanyPassport.onmicrosoft.com",
    "SignUpSignInPolicyId": "B2C_1_myCompanySignUpSignIn",
    "ResetPasswordPolicyId": "B2C_1_myCompanyPasswordReset",
    "EditProfilePolicyId": "B2C_1_myCompanyProfile",
    "TaskServiceUrl": "https://localhost:44337/",
    "ApiIdentifier": "https://myCompanyPassport.onmicrosoft.com/taskapi",
    "ReadScope": "read",
    "WriteScope": "write"
  },
  "Logging": {
    "LogLevel": {
      "Default": "Warning"
    }
  },
  "AllowedHosts": "*"
}

Here’s my API Startup.cs:

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication(AzureADB2CDefaults.BearerAuthenticationScheme)
        .AddAzureADB2CBearer(options => Configuration.Bind("AzureAdB2C", options));

    services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
}

// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }
    else
    {
        app.UseHsts();
    }

    app.UseHttpsRedirection();
    app.UseAuthentication();
    app.UseMvc();
}

My API appsettings.json:

{
  "AzureAdB2C": {
    "Instance": "https://myCompanyPassport.b2clogin.com/tfp/",
    "ClientId": "213764b3-8c2a-4bf6-9e69-355495a8f14e",
    "ClientSecret": "------------------------",
    "Domain": "myCompanyPassport.onmicrosoft.com",
    "SignUpSignInPolicyId": "B2C_1_myCompanySignUpSignIn",
    "ReadScope": "read",
    "WriteScope": "write"
  },
  "Logging": {
    "LogLevel": {
      "Default": "Warning"
    }
  },
  "AllowedHosts": "*"
}

Manoj Choudhari Manoj Choudhari · Accepted Answer · 2019-01-03T17:43:40

Did you try this ( addazureadbearer api )

   services.AddAuthentication(sharedOptions =>
        {
            sharedOptions.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
        })
        .AddAzureAdBearer(options => Configuration.Bind("AzureAd", options));

Azure AD B2C Web API Using .NET Core 2

1 Answers