0

We have configured OpenID Connect provider in Azure B2C that supports 'Authorization Code Flow with PKCE' (does not support implicit flow)

Its a single page angular app, when user select the user store during login the auth request throws an error : "invalid_request, Error Description: Missing parameter: code_challenge_method

it does not pass code_challenge & code_challenge_method in request - Am I missing anything?

Also, OpenId connect provider is configured in custom policy as below,

 `<ClaimsProvider>
  <DisplayName>User Login</DisplayName>
  <TechnicalProfiles>
    <TechnicalProfile Id="OIDC-User">
      <DisplayName>User Login</DisplayName>
      <Description>Login with your user account</Description>
      <Protocol Name="OpenIdConnect" />
      <Metadata>
        <Item Key="METADATA">https://idp/.well-known/openid-configuration</Item>
        <Item Key="client_id">clientid</Item>
        <Item Key="response_types">code</Item>
        <Item Key="scope">openid email</Item>
        <Item Key="response_mode">form_post</Item>
        <Item Key="HttpBinding">POST</Item>
        <Item Key="UsePolicyInRedirectUri">false</Item>
      </Metadata>
      <CryptographicKeys>
        <Key Id="client_secret" StorageReferenceId="B2C_1A_AppSecret" />
      </CryptographicKeys>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="oid" />
        <OutputClaim ClaimTypeReferenceId="tenantId" PartnerClaimType="tid" />
        <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
        <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true" />
        <OutputClaim ClaimTypeReferenceId="identityProvider" PartnerClaimType="iss" />
      </OutputClaims>
      <OutputClaimsTransformations>
        <!-- <OutputClaimsTransformation ReferenceId="UserIdentityClaims"/>  -->
        <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
        <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
        <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
        <OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
      </OutputClaimsTransformations>
      <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
    </TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>`

If I just use IDP without going though B2C it works just fine!

Chintan Bhatt
  • 1
  • 1
  • How do you configure OpenID Connect provider? Do you refer to any document? Please provide more details (code and configuration). – Allen Wu Mar 03 '21 at 02:08
  • Hi Allen, I have attached provider technical profile in original post – Chintan Bhatt Mar 03 '21 at 02:29
  • Thanks. How did you set the configuration in your single page angular app? – Allen Wu Mar 03 '21 at 02:39
  • We are using https://www.npmjs.com/package/angular-auth-oidc-client - It works fine, user gets redirected to B2C login page where they can choose this External IDP but when B2C makes request to IDP it does not pass code_challenge and code_challenge_method if it does it works just fine – Chintan Bhatt Mar 03 '21 at 02:45
  • B2C makes auth request as below without code_challange and code_challange_method `https://idp/auth/realms/tell-us-once/protocol/openid-connect/auth?client_id=clientid &redirect_uri=redirecturi &response_type=code &scope=openid+email &response_mode=form_post &nonce=X5KNJBdG8FyeNgw &state=StateProperties6546` – Chintan Bhatt Mar 03 '21 at 03:10
  • Just to note that B2C does work with PKCE - https://medium.com/the-new-control-plane/using-proof-key-for-code-exchange-pkce-in-azure-ad-b2c-9203fbc148fd – rbrayb Mar 03 '21 at 18:39
  • Yes, B2C as a IdP works - my scenario is B2C has a OpenId Connect provider that only supports code flow with PKCE and when B2C makes a auth request to external IdP that request does not have code_challange and code_challange_method – Chintan Bhatt Mar 03 '21 at 23:07

1 Answers1

0

Ok, so B2C does not support PKCE for external IDP’s. The reason being B2C would be consider a “confidential client” in respect to OAuth/OIDC.

Authorization code flow with client secret works fine!

Chintan Bhatt
  • 1
  • 1