Azure AD B2C OpenID Connect provider with code flow - Auth Request from B2C does not pass code challenge and code_challange_method in request

0
votes

We have configured OpenID Connect provider in Azure B2C that supports 'Authorization Code Flow with PKCE' (does not support implicit flow)

Its a single page angular app, when user select the user store during login the auth request throws an error : "invalid_request, Error Description: Missing parameter: code_challenge_method

it does not pass code_challenge & code_challenge_method in request - Am I missing anything?

Also, OpenId connect provider is configured in custom policy as below,

 `<ClaimsProvider>
  <DisplayName>User Login</DisplayName>
  <TechnicalProfiles>
    <TechnicalProfile Id="OIDC-User">
      <DisplayName>User Login</DisplayName>
      <Description>Login with your user account</Description>
      <Protocol Name="OpenIdConnect" />
      <Metadata>
        <Item Key="METADATA">https://idp/.well-known/openid-configuration</Item>
        <Item Key="client_id">clientid</Item>
        <Item Key="response_types">code</Item>
        <Item Key="scope">openid email</Item>
        <Item Key="response_mode">form_post</Item>
        <Item Key="HttpBinding">POST</Item>
        <Item Key="UsePolicyInRedirectUri">false</Item>
      </Metadata>
      <CryptographicKeys>
        <Key Id="client_secret" StorageReferenceId="B2C_1A_AppSecret" />
      </CryptographicKeys>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="oid" />
        <OutputClaim ClaimTypeReferenceId="tenantId" PartnerClaimType="tid" />
        <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
        <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true" />
        <OutputClaim ClaimTypeReferenceId="identityProvider" PartnerClaimType="iss" />
      </OutputClaims>
      <OutputClaimsTransformations>
        <!-- <OutputClaimsTransformation ReferenceId="UserIdentityClaims"/>  -->
        <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
        <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
        <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
        <OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
      </OutputClaimsTransformations>
      <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
    </TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>`

If I just use IDP without going though B2C it works just fine!

1
azureazure-ad-b2cazure-ad-b2c-custom-policy
How do you configure OpenID Connect provider? Do you refer to any document? Please provide more details (code and configuration). – Allen Wu
Hi Allen, I have attached provider technical profile in original post – Chintan Bhatt
Thanks. How did you set the configuration in your single page angular app? – Allen Wu
We are using npmjs.com/package/angular-auth-oidc-client - It works fine, user gets redirected to B2C login page where they can choose this External IDP but when B2C makes request to IDP it does not pass code_challenge and code_challenge_method if it does it works just fine – Chintan Bhatt
B2C makes auth request as below without code_challange and code_challange_method https://idp/auth/realms/tell-us-once/protocol/openid-connect/auth?client_id=clientid &redirect_uri=redirecturi &response_type=code &scope=openid+email &response_mode=form_post &nonce=X5KNJBdG8FyeNgw &state=StateProperties6546 – Chintan Bhatt

1 Answers

0
votes

Ok, so B2C does not support PKCE for external IDP’s. The reason being B2C would be consider a “confidential client” in respect to OAuth/OIDC.

Authorization code flow with client secret works fine!