Blazor WebAssembly Azure B2C Error: AADB2C90205 (insufficient permissions)

Question

I created a sample Blazor WebAssembly app to be secured with Azure B2C using the steps outlined in the Microsoft docs article: https://docs.microsoft.com/en-us/aspnet/core/blazor/security/webassembly/hosted-with-azure-active-directory-b2c?view=aspnetcore-3.1.

The application works except for the authentication. The B2C modal loads to sign-in, but then the UI displays the following error message.

There was an error trying to log you in: 'AADB2C90205: This application does not have sufficient permissions against this web resource to perform the operation.

Here are some redacted screenshots for my B2C configuration (I'm sure the code is correct as it's the default code generated from the dotnet new CLI command).

Any ideas on the configuration error?

App Registrations

API - Overview

API - Authentication

API - Expose an API

Client - Overview

Client - Authentication

Client - API Permissions

Sign-up/in User Flow - Overview

Sign-up/in User Flow - User Attributes

Sign-up/in User Flow - Application Claims

Can you please share us the B2c url?Also, please mask the clientid/secrets with stars(**) as it is public channel — Hari Krishna

TheMagnificent11 TheMagnificent11 · Accepted Answer · 2020-12-02T14:13:22

So it turns out the issue was actually in the code.

I missed a note section in the docs that said I had to manually edit the client app code if API ID URI was untrusted publisher domain similar to https://contoso.onmicrosoft.com/41451fa7-82d9-4673-8fa5-69eff5a761fd, which it was in my case.

Removing the extra https://{TENANT DOMAIN}/ in the Program.cs of the client app fixed things (note the difference between the commented-out line and the line that comes after).

namespace BlazorClient
{
    public class Program
    {
        public static async Task Main(string[] args)
        {
            ...

            builder.Services.AddMsalAuthentication(options =>
            {
                builder.Configuration.Bind("AzureAdB2C", options.ProviderOptions.Authentication);
                //options.ProviderOptions.DefaultAccessTokenScopes.Add("https://***.onmicrosoft.com/https://***.onmicrosoft.com/*******/blazor.client");
                options.ProviderOptions.DefaultAccessTokenScopes.Add("https://***.onmicrosoft.com/*******/blazor.client");
            });

            await builder.Build().RunAsync();
        }
    }
}

Blazor WebAssembly Azure B2C Error: AADB2C90205 (insufficient permissions)

2 Answers