0

Is it possible for AD B2C to be utilized for non-interactive authentication. ie I want to pass-in a username (email-id)/password and be authenticated into application (not API backend but a web application bypassing a login flow - basically auto-login that user interaction with a user/passwords and redirect to a resource)

I have used ROPC for backend API could that be utilized or is there any other way.

Can we get access and id token from a call similar to :

 https://<tenant-name>.b2clogin.com/<tenant-name>.onmicrosoft.com/<policy-name>/oauth2/v2.0/authorize?
client_id=<application-ID>
&nonce=anyRandomValue
&redirect_uri=https://jwt.ms
&scope=<application-ID-URI>/<scope-name>
&response_type=code

without the interactive flow and providing a redirectURL.

Thanks

user14013917
  • 149
  • 1
  • 10

1 Answers1

0

Yes, you can use the same flow for web application too in getting access and id tokens non-interactively.

I tried to reproduce the same in my environment and got below results:

I registered one web application in my B2C tenant and added Redirect URI in Web platform like below:

enter image description here

In Manifest, make sure to enable implicit flow like below:

enter image description here

I exposed one API and granted that API permission to WebApp like below:

enter image description here

Now, I created one resource owner user flow as below:

enter image description here

I got both access and id tokens successfully via Postman with below parameters:

POST https://b2ctenantname.b2clogin.com/b2ctenantname.onmicrosoft.com/<ROPC_policyname>/oauth2/v2.0/token
client_id:<App_ID>
redirect_uri: https://jwt.ms
grant_type:password
username: <UPN_of_B2C user> 
password:xxxxxxxxxxxx
scope:openid https://b2ctenantname.onmicrosoft.com/appID/Custom.Scope
response_type:token id_token

Response:

enter image description here

When I decoded the above access token, I got scp claim successfully with custom scope as below:

enter image description here

Sridevi
  • 10,599
  • 1
  • 4
  • 17
  • Thank you very much. I want to be able to use this access token to allow automatic login to the UI screens (not be challenged with AD B2C login. Call to API I have currently with my ROPC flow, is it possible to use this access_token to continue to UI flow (redirect_url) . Web page 1 --> b2c../oauth2/v2.0/token --> access_token --> web app 2 (it uses ad b2c) but since has access_token should bypass the login screen. Appreciate any pointers. – user14013917 Dec 13 '22 at 01:20