Azure B2C Authentication (angular + .net core Web API) - Neither scope or roles claim was found in the bearer token

Question

i try to do an angular application with MSAL-angular and Azure B2C for authentication. I am able to authenticate the angular app with Azure B2C (i have create a susi flow) and obtain the token as show in image below

so i have create a .net core web api project and modify the appsetting configuration and the start up with this code :

appsetting.json :

    "AzureAdB2C": {
    "Instance": "https://{mytenat}.b2clogin.com/tfp",
    "ClientId": "8xxxx-xxxx-xxxx-xxxx-xxxxxxxxc",
    "Domain": "{mytenat}.onmicrosoft.com",
    "SignUpSignInPolicyId": "B2C_1_susi"
  }

startup.cs

            JwtSecurityTokenHandler.DefaultMapInboundClaims = false;

            services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                    .AddMicrosoftIdentityWebApi(options =>
                    {
                        Configuration.Bind("AzureAdB2C", options);
                        options.TokenValidationParameters.RoleClaimType = "roles";
                        options.TokenValidationParameters.NameClaimType = "name";
                    },
                    options => { Configuration.Bind("AzureAdB2C", options); });

            // By default, the claims mapping will map claim names in the old format to accommodate older SAML applications.
            //'http://schemas.microsodt.com/ws/2008/06/identity/clains/role' instead of 'roles'
            // This flag ensures that the ClaimsIdentity claims collection will be build from the claims in the token
            JwtSecurityTokenHandler.DefaultMapInboundClaims = false;
            //services.Configure<JwtBearerOptions>(JwtBearerDefaults.AuthenticationScheme, options =>
            //{
            //    // The claim in the Jwt token where App roles are available.
            //    options.TokenValidationParameters.RoleClaimType = "roles";
            //});

but if i try to run localy the project and call it with postman i have this error :

**System.UnauthorizedAccessException: IDW10201: Neither scope or roles claim was found in the bearer token. **

i don't understand where is the error. can you help me?

thanks

This should be related to your scope. Are you using delegated permissions? — Carl Zhao
What are your consentScopes? That is, the scope of the administrator consent. — Carl Zhao

Carl Zhao Carl Zhao · Accepted Answer · 2021-04-20T07:06:14

In your question, you have created a web api application and angular app in Azure AD B2C. Next, you need to expose the api of the web api application, and then add permissions to the angular app.

First go to web api.

Then go to angular app>API permissions> add a permission>My APIs>your web api app.

Finally, when you parse the token, you will see the scp:access claim.

Azure B2C Authentication (angular + .net core Web API) - Neither scope or roles claim was found in the bearer token

1 Answers