Scope “scp” missing when Requesting a token in Azure AD B2C

Question

So I am trying to protect a web API using Azure AD B2C but when I try to access an endpoint with the token obtained using "Run user flow" I get the following exception:

System.UnauthorizedAccessException: IDW10201: Neither scope or roles claim was found in the bearer token.

My Code:

I created a new ASP.NET Core App and used the dialog to add authentication automatically.

Some interesting points in the code:

I tried added the following to the appsettings.json file and it didn't help:

"AllowWebApiToBeAuthorizedByACL": true

I tried removing this from the controller and it didn't help:

// The Web API will only accept tokens 1) for users, and 2) having the "access_as_user" scope for this API
static readonly string[] scopeRequiredByApi = new string[] { "access_as_user" };
HttpContext.VerifyUserHasAnyAcceptedScope(scopeRequiredByApi);

In ConfigureServices I have the following code:

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddMicrosoftIdentityWebApi(Configuration.GetSection("AzureAdB2C"));

Azure Portal:

1. I created a new tenant for Azure AD B2C

2. I registered an application

3. API Permissions

Here I have been playing a lot with it, those are the permissions I have enabled right now:

4. Create User flow

Then when I run the user flow this is what I get:

Link used:

https://xxxxxxxxxxx001.b2clogin.com/xxxxxxxxx001.onmicrosoft.com/oauth2/v2.0/authorize?

p=B2C_1_user_flow_test_signinsignup

&client_id=xxxxxxxxxxxx

&nonce=defaultNonce

&redirect_uri=https%3A%2F%2Fjwt.ms

&scope=openid

&response_type=id_token

&prompt=login

I am completely new to azure and after researching the whole internet I can't figure out what is the issue here, and why scp is not in the token I obtain when running the user flow from the link provided in azure portal.

I would really appreciate in help in what I am missing to set up or what I have set up wrongly.

Answer 1

What you are getting is the id token. There is no scp claim for the id token. It only contains the information of the logged-in user. What you are performing is only the logged-in user's operation.

If you want to get scp claims, you should request an access token instead of a id token.

Answer 2

Adding to the Carl answer, With the use of B2C link you'll only get an ID token as it sets the response type to id_token, just like the article states. In order to get an access token your response_type field needs to be 'response_type=code' or 'response_type=code+id_token' and even then JWT.ms wont show it. if you capture a dev tools network trace you'll see two parameters in the authresp frame access_token and id_token. decoding the access_token with jwt.io will show us what you are looking for.