{"id":6068,"date":"2019-08-28T19:17:06","date_gmt":"2019-08-28T19:17:06","guid":{"rendered":"https:\/\/blogs.aaddevsup.xyz\/?p=6068"},"modified":"2019-12-15T06:38:51","modified_gmt":"2019-12-15T06:38:51","slug":"walkthrough-msal-net-client-calling-azure-api-app-with-easy-auth-enabled-in-a-b2c-tenant","status":"publish","type":"post","link":"https:\/\/blogs.aaddevsup.xyz\/2019\/08\/walkthrough-msal-net-client-calling-azure-api-app-with-easy-auth-enabled-in-a-b2c-tenant\/","title":{"rendered":"Walkthrough: MSAL.Net client calling Azure API App with Easy Auth enabled in a B2C tenant"},"content":{"rendered":"

In a previous<\/a> blog post, I talked about how to use MSAL.Net client application to call an Azure Function App with Easy Auth enabled in a regular tenant. In this post, I’ll describe the process to use an MSAL.Net client application to call a Web API application with Easy Auth enabled in a B2C<\/a> tenant. I assume you already have an API App created on Azure App Service. If you don’t have one, follow the instruction at https:\/\/docs.microsoft.com\/en-us\/azure\/app-service\/app-service-web-tutorial-rest-api<\/a> to create a sample API app and deploy to Azure App Service. Let’s go through this exercise:<\/p>\n

    \n
  1. \n

    Register the API App in a B2C tenant<\/h2>\n<\/li>\n<\/ol>\n

    Log into your Azure AD B2C tenant -> Click on the ‘Azure AD B2C’ blade -> Applications -> Add to add a new application with the following setting:<\/p>\n

    \n\n\n\n<\/colgroup>\n\n\n\n\n\n\n\n
    Name<\/td>\nEnter a name<\/td>\n<\/tr>\n
    Include web app \/ web API<\/td>\nyes<\/td>\n<\/tr>\n
    Allow implicit flow<\/td>\nyes<\/td>\n<\/tr>\n
    Reply URL<\/td>\nhttps:\/\/<sitename>.<\/span>azurewebsites.net\/.auth\/login\/aad\/callback<\/td>\n<\/tr>\n
    App ID URI<\/td>\n.onmicrosoft.com\/demo”>https:\/\/<tenant><\/span>.onmicrosoft.com\/demo<\/a> or enter your own scope<\/td>\n<\/tr>\n
    Native client<\/td>\nno<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

    Note:<\/strong>
    \n<\/span>for the Reply URL, you will need to enter the URL in that format since the aad\/callback endpoint gets processed by the Easy Auth module<\/p>\n

    Here is what mine looks like after this is done. My API App is hosted at https:\/\/bhwebapitest.azurewebsites.net. Take note of the Application ID as you will need it later to configure Easy Auth<\/strong><\/p>\n

    \"\"<\/p>\n

    Click on ‘Published scopes’ and take note of the full scope value since you will need this for the MSAL.Net application<\/strong>.<\/p>\n

    \"\"<\/p>\n

      \n
    1. \n

      Register an MSAL.Net client app in a B2C tenant<\/h2>\n<\/li>\n<\/ol>\n

      Follow the step above to create a new app registration with the following setting:<\/p>\n

      \n\n\n\n<\/colgroup>\n\n\n\n\n
      Name<\/td>\nEnter the name of the client app<\/td>\n<\/tr>\n
      Include web app \/ web API<\/td>\nNo<\/td>\n<\/tr>\n
      Include native client<\/td>\nyes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

      Once the application is created, click on API access -> Add -> select the API app created above in step 1 and select all available scopes and click on OK.<\/p>\n

      Here is what mine looks like after this is done. Take Note of the Application ID in the Properties blade as you will need it for the MSAL.Net application<\/strong><\/p>\n

      \"\"<\/p>\n

        \n
      1. \n

        Create a new User flow policy in the B2C tenant<\/h2>\n<\/li>\n<\/ol>\n

        In the Azure AD B2C blade -> select User flows (policies) -> click on “New user flow” and create a new “Sign up and sign in” policy. Follow the wizard to provide a policy name and select any attribute you desire under “User attributes and claims” section.<\/p>\n

        Once the policy is created, select that policy and click on “Run user flow” button. Take note of the URL under “Run user flow” as you will need it to configure Easy Auth<\/strong>.<\/p>\n

        My policy in this case in this case is B2C_1_SiUpIn and the well-known configuration URL is https:\/\/hellob2c.b2clogin.com\/tfp\/hellob2c.onmicrosoft.com\/B2C_1_SiUpIn\/v2.0\/.well-known\/openid-configuration<\/p>\n

        Note<\/strong><\/span> that this URL is dependent upon the domain used in the “Select domain” drop down. I used the format b2clogin.com domain in this case. If you change this domain to login.microsoftonline.com, the well-known configuration URL will be changed accordingly to https:\/\/login.microsoftonline.com\/tfp\/hellob2c.onmicrosoft.com\/B2C_1_SiUpIn\/v2.0\/.well-known\/openid-configuration.<\/p>\n

        \"\"<\/p>\n

          \n
        1. \n

          Enable Easy Auth for the API Application<\/h2>\n<\/li>\n<\/ol>\n

          Follow the steps in the previous blog to turn on Easy Auth. Choose Advanced Mode instead of Express Mode for this<\/strong>. For ‘Client ID’ field enter the Application ID of the B2C App created in step 1 above and use the well-known URL in the “Run user flow” for the “Issuer Url” field (see screen shot below). Click OK and Save to save the setting. Test the Easy Auth configuration in the web browser by browsing to your web API URL to make sure it’s working correctly. You should be prompted for login. Use an account in the B2C tenant to verify you can log in and get to the API application.<\/p>\n

          \"\"<\/p>\n

            \n
          1. \n

            Create an MSAL.Net application<\/h2>\n<\/li>\n<\/ol>\n

            Create a C# Console Application with the following code. Make sure to add the MSAL.Net nuget package (Microsoft.Idenity.Client) to the application. You will need to change the following parameter for your application<\/p>\n

            \n\/\/ your b2c tenant name\nprivate static readonly string Tenant = \"<tenant>.onmicrosoft.com\";\n\/\/ your b2c tenant name\nprivate static readonly string AzureAdB2CHostname = \"<tenant>.b2clogin.com\";\n\/\/ Application ID of the MSAL.Net app\nprivate static readonly string ClientId = \"<Application ID>\";\n\/\/ Your Policy Name. Should be something similar to B2C_1_SomeName\npublic static string PolicySignUpSignIn = \"<Your Policy Name>\";\n\/\/ use the full API scope in the \"Published scopes\" of the API app\npublic static string[] ApiScopes = { \"<Your Web API scope>\" };\n\/\/ Your Web API\npublic static string ApiEndpoint = \"<Your API endpoint>\";\n<\/pre>\n
            [gist id=”4e9f87996c88d65f26f247b381ea6505″ file=”MSALNetB2C.cs”]
            \nNow you can test your MSAL.Net application to verify that it can successfully call the Web API application.<\/p>\n
            If you are using login.microsoftonline.com domain\u2026<\/h2>\n
            Just in case you are using login.microsoftonline.com domain instead of the b2clogin.com domain, in the Easy Auth ‘Issuer Url’ configuration you will need to enter the well-known configuration URL for login.microsoftonline.com as seen in the Azure AD B2C portal.<\/p>\n
            For the MSAL.Net application everything else is the same as above except for the AzureAdB2CHostname variable and it should be “login.microsoftonline.com”<\/p>\n
            private static readonly string AzureAdB2CHostname = “login.microsoftonline.com”;<\/span><\/p>\n
            References<\/h2>\n
            https:\/\/cgillum.tech\/2016\/08\/10\/app-service-auth-and-azure-ad-b2c-part-2\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
            In a previous blog post, I talked about how to use MSAL.Net client application to call an Azure Function App with Easy Auth enabled in a regular tenant. In this post, I’ll describe the process to use an MSAL.Net client application to call a Web API application with Easy Auth enabled in a B2C tenant. I assume you already have an API App created on Azure App Service. If you…<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,5,7,8],"tags":[36,40,59],"class_list":["post-6068","post","type-post","status-publish","format-standard","hentry","category-authentication","category-azure-ad","category-b2c","category-easy-auth","tag-authentication","tag-azure-active-directory","tag-easy-auth"],"_links":{"self":[{"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/posts\/6068"}],"collection":[{"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/comments?post=6068"}],"version-history":[{"count":52,"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/posts\/6068\/revisions"}],"predecessor-version":[{"id":6673,"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/posts\/6068\/revisions\/6673"}],"wp:attachment":[{"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/media?parent=6068"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/categories?post=6068"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/tags?post=6068"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}