Azure AD B2C second ROPC flow is returning AADB2C90225 error (username or pass provided in the request are invalid) although credentials are correct.

Question

Azure AD B2C second ROPC flow is returning AADB2C90225 error (username or pass provided in the request are invalid) although credentials are correct.

Javier Gutiérrez 25

(I didn't find "Azure AD B2C" tag, so I put Azure App Service instead).

I'm implementing a second ROPC flow in my Azure AD B2C Policies for a new authentication endpoint used to get an access token against some user credentials (users that differ from the user of my original auth endpoint) in my API. The problem is, having passed through the documentation here at https://learn.microsoft.com/en-us/azure/active-directory-b2c/add-ropc-policy?tabs=app-reg-ga&pivots=b2c-custom-policy implementing what was left to implement (basically a different user journey), I'm getting an AADB2C90225 error claiming that the username or password in the request are invalid.

¿What could it be?

Javier Gutiérrez 25 Reputation points

2024-01-16T11:11:22.63+00:00

Hi @Shweta Mathur, thanks for the rapid response.

The user account does not fall into any of the cases you list. User account can't be tested in my first ROPC because that flow is for one and only one user group (different than the first user's group).
Javier Gutiérrez 25 Reputation points

2024-01-17T12:36:02.76+00:00

Now I did something different: I removed the userValidation() orchestrationStep in my policies so that the original ROPC don't validate user. I did it in order to let all B2C users to get an access token. I plan to let them use endpoints depending on their group.

The new problem is that I assign the user I need to the group I need (API group created in B2C) and the role claim in the access token for that user reads "User" group instead of "API"...
Shweta Mathur 30,266 Reputation points Microsoft Employee

2024-01-24T06:12:12.88+00:00

@Javier Gutiérrez
Group is not directly supported in Azure AD B2C. You can't use the groups from the underlying Azure AD tenant to manage access of customers to applications. Apparently, you can't define app roles and then assign groups to applications and put customers into groups. If you are working with groups in Azure AD B2C out of box, then this needs to troubleshoot further.

Accepted answer

0 additional answers

Your answer

Javier Gutiérrez 25 Reputation points

2024-01-16T11:11:22.63+00:00

Hi @Shweta Mathur, thanks for the rapid response.

The user account does not fall into any of the cases you list. User account can't be tested in my first ROPC because that flow is for one and only one user group (different than the first user's group).
Javier Gutiérrez 25 Reputation points

2024-01-17T12:36:02.76+00:00

Now I did something different: I removed the userValidation() orchestrationStep in my policies so that the original ROPC don't validate user. I did it in order to let all B2C users to get an access token. I plan to let them use endpoints depending on their group.

The new problem is that I assign the user I need to the group I need (API group created in B2C) and the role claim in the access token for that user reads "User" group instead of "API"...
Shweta Mathur 30,266 Reputation points Microsoft Employee

2024-01-24T06:12:12.88+00:00

@Javier Gutiérrez
Group is not directly supported in Azure AD B2C. You can't use the groups from the underlying Azure AD tenant to manage access of customers to applications. Apparently, you can't define app roles and then assign groups to applications and put customers into groups. If you are working with groups in Azure AD B2C out of box, then this needs to troubleshoot further.

Answer 1

Shweta Mathur 30,266 Microsoft Employee

Hi @Javier Gutiérrez ,

Thanks for reaching out.

Could you please check that user account you are using is not fall under below:

ROPC doesn’t work when there's any interruption to the authentication flow that needs user interaction. For example, when a password expires or needs to be changed, multifactor authentication is required, or when more information needs to be collected during sign-in (for example, user consent).
ROPC supports local accounts only. Users can’t sign in with federated with Identity providers like Microsoft, Google+, Twitter, AD-FS, or Facebook.
Session Management, including keep me signed in, isn't applicable.

Did you try that user account is working for your first ROPC flow?

Please confirm so we can help you further.

Thanks,

Shweta

Javier Gutiérrez 25 Reputation points

2024-02-07T14:00:39.38+00:00

Thank you for all Shweta.

Finally, I realized that there is a technical profile that points to my API on development environment while I was looking to receive that request on my local environment. In order words, B2C receives an authorization request from my API, then sends a request to another endpoint of my API on dev environment to gather that user's group, and then it goes back to B2C and back to the API again. All it was needed was to merge my local branch changes to development in order for them to be available. Now it all works as supposed.

Share via

Azure AD B2C second ROPC flow is returning AADB2C90225 error (username or pass provided in the request are invalid) although credentials are correct.

0 additional answers

Your answer