B2C Tutorial Returning 401: Unauthorized

Question

Hi, I'm currently working with Azure AD B2C with a SPA. I'm following this tutorial to assist me with creating exactly what I need, however when I try to call my API I get an "Error: 401 Unauthorized". Looking into the issue more, I've noticed that the token required is not being passed through to the API- there is no access token associated with my user when I log into the system.

I found that on my frontend app registration, I also do not have permissions granted for my API - the status states "Not granted for...company name". Would this be enough to prevent an access token from being generated in B2C?

Edit: I now have the token generation working, however I am still getting a 401: Unauthorized Error.

Answer 1

Hi @hampton123 ,

Thanks for reaching out.

Your understanding is correct here. You are getting 401 unauthorized while calling the API using bearer token which is not authorized to call your API.

You will be able to get the access token while authenticating using SPA application but as you mentioned you did not grant permissions to your SPA application to access the API. Then you can't use your SPA application to call your API.

If you decode your access token using https://jwt.ms you should have scope "Hello" (as per doc you mentioned) to call the API.

The above access token has the audience which shows the client id of backend application and scope "hello" which we expose in our backend API.

This access token is authorized to call the f996-xxx-xx API(backend) with scope "Hello".

If you get the access token without audience and scope, you will not be authorized to call the API and will give error.

Hope this will help.

Thanks,

Shweta

---

Please remember to "Accept Answer" if answer helped you.

Answer 2

This thread I had here helped me solve this issue: https://learn.microsoft.com/en-us/answers/questions/1339396/does-the-azure-function-coding-language-matter-for

Basically, the Azure Function that was being called was left as it's default name ("HttpTrigger1") and not "hello" like it should have been.