Azure AD B2C and Blazor Web App Net8 Authentication

[WakeUpHugo]

Is there an existing issue for this?

• I have searched the existing issues

Is your feature request related to a problem? Please describe the problem.

I have tried configuring azure ad b2c with the new Blazor Web App in Net 8 RC1 , following the same process I would do with net6 or 7, but I seem to fail.

Is this not available for testing in net8 and blazor?

Describe the solution you'd like

To be able to integrate with B2C in the same way as net7.

Additional context

No response

[AlexCastroAlex]

Same here.
I tested .NET 7.0 server project and works like a charm.
Then i created a .NET 8.0 RC1 Blazor Web App with Audience but it does not work.
I can log to my tenant but the return url writes me an error :
Error: IDX40001: Issuer: 'https://myadb2c.b2clogin.com/mytenant/v2.0/', does not match any of the valid issuers provided for this application.

[DevyDevly]

The same problem exists trying to connect to B2C with just a vanilla ASP.NET Core web app.
Works in the latest .NET7 project, but not .NET8 RC1.

In RC1 the app fires up and I can proceed through Sign In (correctly), but an authentication failure is always returned:

"IDX40001: Issuer: 'https://mytenant.b2clogin.com//v2.0/', does not match any of the valid issuers provided for this application.

{
  "AzureB2C": {
    "Instance": "https://mytenant.b2clogin.com/",
    "Domain": "mytenant.onmicrosoft.com",
    "TenantId": "<tenant id guid>",
    "ClientId": "<client id guid>",
    "ClientCapabilities": [ "cp1" ],
    "CallbackPath": "/signin-oidc",
    "SignUpSignInPolicyId": "B2C_1A_MY_SIGNIN_TOTP",
    "SignUpPolicyId": "B2C_1A_MY_SIGNUP_TOTP",
    "SignInPolicyId": "B2C_1A_MY_SIGNIN_TOTP",
    "SignedOutCallbackPath": "/signout/B2C_1A_MY_SIGNIN_TOTP",
    "ResetPasswordPolicyId": "B2C_1A_MY_PASSWORDRESET_TOTP",
    "ChangePasswordPolicyId": "B2C_1A_MY_PASSWORDCHANGE_TOTP",
    "EditProfilePolicyId": "B2C_1A_PROFILEEDIT",
    "EnablePiiLogging": true
  },
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*"
}

var builder = WebApplication.CreateBuilder(args);
var configManager = builder.Configuration;

builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureB2C"));

builder.Services.AddAuthorization(options =>
{
    options.FallbackPolicy = options.DefaultPolicy;
});
builder.Services.AddRazorPages()
    .AddMicrosoftIdentityUI();

var app = builder.Build();

if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Error");
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseRouting();

app.UseAuthentication();

app.UseAuthorization();

app.MapRazorPages();
app.MapControllers();

app.Run();

[AlexCastroAlex]

This is a workaround i made just to wait for a fix.
The fix consists to force the issuer value but not clearly the cleanest :(

builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(options =>
    {
        builder.Configuration.Bind("AzureAd", options);
        // Restrict users to specific belonging to specific tenants
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidIssuers = new string[] {$"{builder.Configuration.GetValue<string>("AzureAd:Instance")}/{builder.Configuration.GetValue<string>("AzureAd:TenantId")}/v2.0/" },
            ClockSkew = TimeSpan.FromSeconds(15),
            // 15 seconds tolerance for the expiration date instead of the 5 minutes default
            //NameClaimType = "name"; // eventually validate that the name Claim is present
        };
    });

[DevyDevly]

Many thanks for the workaround @AlexCastroAlex !
:)

[halter73]

This is a duplicate of #51005 which has now been fixed.

[jaliyaudagedara]

@halter73, I am still seeing the same issue:

Bearer was not authenticated. Failure message: IDX40001: Issuer: 'https://something.b2clogin.com/<tenantId>/v2.0/', does not match any of the valid issuers provided for this application.

I am on .NET 8 and Microsoft.Identity.Web: 2.15.5

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApi(Configuration, "AzureAdB2C");