How do you authenticate AAD B2C using MSAL?

Question

I have a working version of a Client/Server authentication using ADAL. However, it appears that the B2C AAD doesn't work well with ADAL when you want to use Local Accounts (that is, just a username or just an email address with no backing authenticator other than AAD). It appears the API we should be using for Local Accounts is the alpha release of MSAL. So far, so good. I'm able to create a local user using the Graph API and using the following code, I appear to be authenticating the local user '[e-mail]':

        this.pca = new PublicClientApplication("a4828eaa-42f6-418a-8062-f857130b69ce");
        AuthenticationResult result = await this.pca.AcquireTokenAsync(
            new string[] { "a4828eaa-42f6-418a-8062-f857130b69ce" },
            string.Empty,
            UiOptions.ForceLogin,
            null,
            null,
            "https://login.microsoftonline.com/" + "darkbondpublic.onmicrosoft.com",
            "B2C_1_sign-in");

The problem is that I pass the security token from 'result.Token' back to the server using a custom security token mechanism in WCF. The code on the server, which used to work with ADAL, no longer seems to accept the security token from the above call:

JwtSecurityTokenHandler tokenHandler = new JwtSecurityTokenHandler();
Microsoft.IdentityModel.Tokens.SecurityToken securityToken = null;
ClaimsPrincipal claimsPrincipal = tokenHandler.ValidateToken(userName, this.GetTokenValidationParameters(MetadataAddress), out securityToken);
Thread.CurrentPrincipal = claimsPrincipal;

The error message is:

Can anyone tell me what is going on here? Do I need a different method of authenticating on the server?

Answer 1

I think the problem is: you are sending request to V1 endpoint but AAD B2C uses V2 endpoint with the authority: https://login.microsoftonline.com/tfp/{tenantId}/{policyName}/v2.0/

Metadata for v2 endpoint is available at https://login.microsoftonline.com/tfp/{tenantId}/{policyName}/.well-known/openid-configuration

Can you update your Urls and make one more attempt?

To see an authority in Azure Portal select your policy, then:

1. Locate your Policy
2. Click "Edit"
3. Click "Token, session & SSO config"
4. Expand "Issuer (iss) claim"

Azure (uses V1 endpoint) and Azure AD B2C (uses V2 endpoint) use different set of keys to sign tokens, therefore it is important to download public keys from the right location - originally you downloaded it from V1 but instead need to use V2.

Answer 2

The metadata endpoint you config for Azure AD B2C tenant is incorrect. Here is the correct one for your reference:

https://login.microsoftonline.com/{tenantId}/v2.0/.well-known/openid-configuration?p=B2C_1_Sign_In

We can find the metadata for the specific policy from the new Azure portal like figure below.

And in the metadata should able to see the keys endpoint like below:

https://login.microsoftonline.com/{tenant}/discovery/v2.0/keys?p={policy}

We can find the key with kid gfIKIH-yZ3phRHRyjnsHIqZMaePLGAELzPat0CNY4sA like below figure: