Azure AD B2C Custom Policy as a Federated Identity Provider in AWS Cognito User Pool

Question

I have an Azure AD B2C Custom Policy defined with OpenId Connect. I ahve four custom claims added in the policy and they correctly appear in the response (id_token) of the policy when tested using the B2C Custom Policy 'Run Now' menu in Azure portal.

I want to integrate this custom policy as a Federated Identity Provider in AWS Cognito User Pool. I have followed the standard process to integrate the same. When tried to test this integration through 'Hosted UI' alternative in AWS, I get an error like below - 'No access token in IdP response'. I have verified with AWS Support and various logs in AWS. In this case, AWS Cognito does receive the auth code from B2C Custom Policy, however token request does not seem to go correctly. AWS Support mentioned that this could be due to incorrect scope values defined.
For the custom policy, I am using the identity experience framework.

As part of the same, have registered 'IdentityExperienceFrameworkApp', 'ProxyIdentityExperienceFrameworkApp' and a main app 'myapp' in B2C tenant app registrations.

For 'IdentityExperienceFrameworkApp', a user_impersonation scope has been added and admin consent given. The scope value is in the format https://{mytenant}.onmicrosoft.com/{client_id for IdentityExperienceFrameworkApp}/user_impersonation. This app also has openid and offline_access api permissions.

For 'ProxyIdentityExperienceFrameworkApp', under api permissions, openid, offline_access and 'IdentityExperienceFrameworkApp's user_impersonation scope has been added. Also given admin consent for the same.

For the main app 'myapp', under api permissions, openid, offline_access and 'IdentityExperienceFrameworkApp's user_impersonation scope have been added.

Currently, I am using the below scopes when requesting from Cognito - openid profile email offline_access {myapp_client_id}

In the above scope, {myapp_client_id} is the client id for the application registered in Azure AD B2C and which is used to configure the app client in AWS Cognito.

If we look at this documentation for OpenId Connect Scopes, there are three scopes quoted -
openid - To request id_token

offline_access - To request refresh token

00000000-0000-0000-0000-000000000000 - Client Id as the scope

Can you clarify what will be this client id value to be added in the scope? Will it be same as {myapp_client_id} described above.

In the request example here, the scope parameter has a value of <application-ID-URI>/<scope-name>

Kindly help to address this issue as I am stuck with it from almost couple of weeks and need to resolve it urgently.

Answer 1

Hi @Anand Patil ,

Thanks for reaching out.

The applications you registered IdentityExperienceFrameworkApp and ProxyIdentityExperienceFrameworkApp are the basic setup for any custom policy.

To use Azure AD B2C as IDp for Amazon Congnito, you need to register one new B2C application by passing Amazon Cognito hosted UI domain name in redirect URL.

https://learn.microsoft.com/en-us/azure/active-directory-b2c/tutorial-register-applications?tabs=app-reg-ga

Now to add this application as open id connect IDP in user pool,

Take the client id of the above registered application with scope openid , profile.

Reference - https://dev.to/danielbayerlein/how-to-use-azure-ad-b2c-as-idp-for-amazon-cognito-28nj

Hope this will help.

Thanks,

Shweta

Answer 2

The client ID value that needs to be added in the scope for Azure AD B2C custom policy is the client ID of the IdentityExperienceFrameworkApp. This is the same client ID that was recorded in the earlier step. The scope value should be in the format https://{mytenant}.onmicrosoft.com/{client_id for IdentityExperienceFrameworkApp}/{scope-name}. In this case, the scope name is user_impersonation.

It is also important to ensure that the correct scope values are defined in the AWS Cognito User Pool. The scope values should include openid, profile, email, offline_access, and the user_impersonation scope.

If the issue persists, it may be helpful to check the logs in both Azure AD B2C and AWS Cognito to identify any errors or issues with the token request.

References:

• Working with Azure AD B2C Custom Policies - Expose the API by adding a scope
• Pass an identity provider access token to your application in Azure Active Directory B2C (b2c-custom-policy)
• Tutorial: Create user flows and custom policies in Azure Active Directory B2C (b2c-custom-policy) - Register Identity Experience Framework applications

---