EditProfile Throw error for Azure AD B2C solution "1-WebApp-OIDC/1-5-B2C" #399

manoj1201 · 2020-08-26T07:45:53Z

Please provide us with the following information:

This issue is for a: (mark with an `x`)

- [x] bug report -> please search issues before submitting
- [ ] feature request
- [x] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

The issue was found for the following scenario:

Please add an 'x' for the scenario(s) where you found an issue

Repro-ing the issue

Repro steps

Create User flow and configured Sign In and Edit Profile flow with below user attribute

Display Name - Out of the box
PhoneNumber - Custom create property type string.
Country/Region -Out of the box.
Downloaded this solution "https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/tree/master/1-WebApp-OIDC/1-5-B2C" and configured as per documentation.
Sign In working fine at localhost as well as deployed Web App.
After Sign In, When i click Edit Profile, It Prompt proper screen and take the input, as soon as i save it re-direct to error page.

Error Page Url : https://localhost:44316/MicrosoftIdentity/Account/Error
An error occurred while processing your request.
Request ID: |b8a8d858-48bf2c5956a60f9e.

Expected behavior
Edit Profile, When i use User flow run option, It working fine as i used https://jwt.ms as redirect url -> which return me valid token and details. Looks like issue with uploaded solution.

Actual behavior

Possible Solution

Additional context/ Error codes / Screenshots

Any log messages given by the failure

Add any other context about the problem here, such as logs.

You can enable Middleware diagnostics by uncommenting the following lines
You can enable personally identifiable information in your exceptions to get more information in the open id connect middleware see Seeing [PII is hidden] in log messages
Logging for MSAL.NET is described at Loggin in MSAL.NET

OS and Version?

Windows 7, 8 or 10. Linux (which distribution). macOS (Yosemite? El Capitan? Sierra?)
Desktop Operating System: Windows 10

Versions

of ASP.NET Core, of MSAL.NET

I am using ASP.NEt Core 3.1

Attempting to troubleshooting yourself:

did you go through the README.md in the folder where you found the issue?
did you go through the documentation:
- Scenario: Web app that signs in users
- Scenario: Web app that calls web APIs

Mention any other details that might be useful

Thanks! We'll be in touch soon.

The text was updated successfully, but these errors were encountered:

manoj1201 · 2020-08-26T07:48:15Z

Added Operating system version and .NetCore Version details

pmaytak · 2020-08-26T18:25:15Z

Hi @manoj1201. Could you provide a detailed error message? ASPNETCORE_ENVIRONMENT should be set to Development in launchSettings.json or just remove this and just use app.UseDeveloperExceptionPage(); all the time.

Also are all the policies specified in config match what's in AAD?

manoj1201 · 2020-08-27T06:26:48Z

@pmaytak , Thanks for info.

I am using Userflow:
B2C_1_SignUpIn for Sign In or Sign Up -> Working fine.
B2C_1_ProfileEdit -> When i run using run flow button via portal with https://jwt.ms as redirect url. it works fine. I followed again all steps and documentation https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/tree/master/1-WebApp-OIDC/1-5-B2C .
Invalid grant error looks strange.

Getting below error at local host:-

fail: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[52]
Message contains error: 'invalid_grant', error_description: 'AADB2C90088: The provided grant has not been issued for this endpoint. Actual Value : B2C_1_SignUpIn and Expected Value : B2C_1_ProfileEdit
Correlation ID: dc2e2832-98f1-4f26-93b5-4a57eb113f1f
Timestamp: 2020-08-27 05:44:02Z
', error_uri: 'error_uri is null', status code '400'.
fail: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[17]
Exception occurred while processing message.
Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolException: Message contains error: 'invalid_grant', error_description: 'AADB2C90088: The provided grant has not been issued for this endpoint. Actual Value : B2C_1_SignUpIn and Expected Value : B2C_1_ProfileEdit
Correlation ID: dc2e2832-98f1-4f26-93b5-4a57eb113f1f
Timestamp: 2020-08-27 05:44:02Z
', error_uri: 'error_uri is null'.
at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.RedeemAuthorizationCodeAsync(OpenIdConnectMessage tokenEndpointRequest)
at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()

pmaytak · 2020-08-27T07:15:08Z

@manoj1201 Can you verify which version of Microsoft identity Web package you're using? Try 0.3.0-preview (it's is the latest) if you're not already.

@jennyf19 I thought we had a similar issue like this and it was fixed? (Maybe it was 467?) I think the problem was that user flow parameter passed in to GetAccessTokenForUserAsync is null so it uses the default one.

jmprieur · 2020-08-27T08:44:26Z

I could confirm that this reproes in a B2C Web app that sign-ins users (1-WebApp-OIDC/1-5-B2C), but not in a B2C web app that signs-in users and calls a Web API (our test app works well).

Analysis

What happens, is that in AzureADB2COpenIDConnectEventHandlers.OnRedirectToIdentityProvider we request an IdTokenCode even in the OIDC case (when the app does not call a Web API)

       context.ProtocolMessage.ResponseType = OpenIdConnectResponseType.CodeIdToken;

https://github.com/AzureAD/microsoft-identity-web/blob/e83d7bb8efb6909ac31d69b0de50d7d2ff8bd4c5/src/Microsoft.Identity.Web/AzureADB2COpenIDConnectEventHandlers.cs#L35

When the code is received, Microsoft.Identity.Web does not try to redeem it (because Startup.cs does not contain EnableTokenAcquisitionToCallDownstreamApi), but ASP.NET Core tries to redeem it, and it fails as it's not as clever as Microsoft.Identity.Web to understand the context.

Suggestion to fix it

In:

https://github.com/AzureAD/microsoft-identity-web/blob/e83d7bb8efb6909ac31d69b0de50d7d2ff8bd4c5/src/Microsoft.Identity.Web/AzureADB2COpenIDConnectEventHandlers.cs#L35

I suggest we request CodeIdToken only if there is either a non null options.ClientSecret or options.ClientCertificates is not null and not empty, otherwise, just request IdToken. This will distinguish the case sign-in-users-and calls-web-api (where we want a code), and the case sign-in-users only (where we don't want the code)

BTW, @jennyf19, this should also fix [Bug]Template IndividualAuth B2C Password reset uses default policy #467

jmprieur · 2020-08-27T08:51:57Z

@manoj1201 thanks for raising this issue. We'll fix it ASAP (in Microsoft.Identity.Web)
Meanwhile there is a work around which is call .AddMicrosoftWebAppCallsWebApi(Configuration, "AzureAdB2C") after .AddMicrosoftWebApp

(or if you are using 0.3.0-preview, .AddMicrosoftWebAppCallsWebApi(Configuration, "AzureAdB2C") after .AddMicrosoftWebApp

            services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
                    .AddMicrosoftIdentityWebApp(Configuration, "AzureAdB2C")
                        .EnableTokenAcquisitionToCallDownstreamApi(initialScopes: new string[] { Configuration["TodoList:TodoListScope"] })
                        .AddInMemoryTokenCaches();

manoj1201 · 2020-08-27T11:54:13Z

Hello @pmaytak

As suggested, I changed the nuget package "Microsoft.Identity.Web.UI" & "Microsoft.Identity.Web" with 0.3.0-preview.

It asked to change the obsolete function in stratup.cs file. I changed below line services.AddMicrosoftWebAppAuthentication(Configuration, "AzureAdB2C")
with services.AddMicrosoftIdentityWebAppAuthentication(Configuration, "AzureAdB2C");

When the ran the solution and getting same issue, Below is error for your reference
fail: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[52]
Message contains error: 'invalid_grant', error_description: 'AADB2C90088: The provided grant has not been issued for this endpoint. Actual Value : B2C_1_SignUpIn and Expected Value : B2C_1_ProfileEdit
Correlation ID: dca50c3f-154c-4508-b7ea-7901d9cda75f
Timestamp: 2020-08-27 11:45:12Z
', error_uri: 'error_uri is null', status code '400'.
fail: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[17]
Exception occurred while processing message.
Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolException: Message contains error: 'invalid_grant', error_description: 'AADB2C90088: The provided grant has not been issued for this endpoint. Actual Value : B2C_1_SignUpIn and Expected Value : B2C_1_ProfileEdit
Correlation ID: dca50c3f-154c-4508-b7ea-7901d9cda75f
Timestamp: 2020-08-27 11:45:12Z
', error_uri: 'error_uri is null'.
at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.RedeemAuthorizationCodeAsync(OpenIdConnectMessage tokenEndpointRequest)
at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()

Hello @jmprieur
As you mentioned, your suggestion hold good for WebAPP with WebAPI, But i am using WebAPP only,

jmprieur · 2020-08-27T12:28:00Z

@manoj1201, it's a work around. We are going to fix this ASAP.

Meanwhile, if you don't want to use that work around, you could try the following work around, which should work.

           services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
                    .AddMicrosoftIdentityWebApp(Configuration, "AzureAdB2C");

            services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme, options =>
            {
                var previousOptions = options.Events.OnRedirectToIdentityProvider;
                options.Events.OnRedirectToIdentityProvider = async context =>
                {
                    await previousOptions(context);
                    context.ProtocolMessage.ResponseType = Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectResponseType.IdToken;
                };
            });

manoj1201 · 2020-08-27T13:01:01Z

Thanks @jmprieur for your quick prompt. Its really appreciable.
As suggested, I added above shared code snippet with Configure Service function in Startup.cs file. Its works like charm.

Modified Function
public void ConfigureServices(IServiceCollection services)
{
services.Configure(options =>
{
options.CheckConsentNeeded = context => true;
options.MinimumSameSitePolicy = SameSiteMode.Unspecified;
options.HandleSameSiteCookieCompatibility();
});

        services.AddMicrosoftIdentityWebAppAuthentication(Configuration, "AzureAdB2C");
        services.AddControllersWithViews().AddMicrosoftIdentityUI();
        services.AddRazorPages();

        //Configuring appsettings section AzureAdB2C, into IOptions
        services.AddOptions();
        services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme, options =>
        {
            var previousOptions = options.Events.OnRedirectToIdentityProvider;
            options.Events.OnRedirectToIdentityProvider = async context =>
            {
                await previousOptions(context);
                context.ProtocolMessage.ResponseType = Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectResponseType.IdToken;
            };
        });
    }

Looking for permanent fix for this issue.

jennyf19 · 2020-08-27T15:01:07Z

@manoj1201 the fix has been merged into master. we'll let you know when we can get out a release. thanks for letting us know about the issue so quickly.

jennyf19 · 2020-08-27T16:41:53Z

included in 0.3.1-preview release. thanks again @manoj1201

jmprieur added bug Something isn't working P1 regression labels Aug 27, 2020

jennyf19 mentioned this issue Aug 27, 2020

set response type to just idToken for web app only scenario in b2c AzureAD/microsoft-identity-web#510

Merged

jennyf19 added the Fixed label Aug 27, 2020

jennyf19 closed this as completed Aug 27, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

EditProfile Throw error for Azure AD B2C solution "1-WebApp-OIDC/1-5-B2C" #399

EditProfile Throw error for Azure AD B2C solution "1-WebApp-OIDC/1-5-B2C" #399

manoj1201 commented Aug 26, 2020 •

edited

Loading

Please provide us with the following information:

manoj1201 commented Aug 26, 2020

pmaytak commented Aug 26, 2020

manoj1201 commented Aug 27, 2020

pmaytak commented Aug 27, 2020

jmprieur commented Aug 27, 2020 •

edited

Loading

jmprieur commented Aug 27, 2020 •

edited

Loading

manoj1201 commented Aug 27, 2020

jmprieur commented Aug 27, 2020

manoj1201 commented Aug 27, 2020

jennyf19 commented Aug 27, 2020

jennyf19 commented Aug 27, 2020

EditProfile Throw error for Azure AD B2C solution "1-WebApp-OIDC/1-5-B2C" #399

EditProfile Throw error for Azure AD B2C solution "1-WebApp-OIDC/1-5-B2C" #399

Comments

manoj1201 commented Aug 26, 2020 • edited Loading

Please provide us with the following information:

This issue is for a: (mark with an x)

The issue was found for the following scenario:

Repro-ing the issue

Any log messages given by the failure

OS and Version?

Versions

Attempting to troubleshooting yourself:

Mention any other details that might be useful

manoj1201 commented Aug 26, 2020

pmaytak commented Aug 26, 2020

manoj1201 commented Aug 27, 2020

pmaytak commented Aug 27, 2020

jmprieur commented Aug 27, 2020 • edited Loading

Analysis

Suggestion to fix it

jmprieur commented Aug 27, 2020 • edited Loading

manoj1201 commented Aug 27, 2020

jmprieur commented Aug 27, 2020

manoj1201 commented Aug 27, 2020

jennyf19 commented Aug 27, 2020

jennyf19 commented Aug 27, 2020

manoj1201 commented Aug 26, 2020 •

edited

Loading

This issue is for a: (mark with an `x`)

jmprieur commented Aug 27, 2020 •

edited

Loading

jmprieur commented Aug 27, 2020 •

edited

Loading