Direct login to Azure AD B2C by passing email and password

Question

Without using a ui interface I need to do user login and get accessToken from node backend. We registered a single page application before and also registered a web API in my AD B2C tenant. I integrated the same in react and its able to sign in and sign up. Now I need to change the flow like I will send the username and password from react to node, and then need to do azure login byusing those credentials. Is it possible to do so

Answer 1

Hi Thanks for the question

Ordinarily you would login the user in the front end using OIDC and either at this point or later acquire an Access token for the backend API - this token would be in the user context.

If the API you call then itself needs to get an access token , but also based on the user context, you'd use an OBO (on behalf of flow)

Unfortunately OBO isnt supported by B2C REF https://learn.microsoft.com/en-us/azure/active-directory-b2c/access-tokens

But, equally you should definitely not pass a user credential over the wire to the API to use - the user should only ever present their credential to the IDP (the sign in and sign up flows in B2C redirect the user from the app to B2C, the app should not and does not ever see the user credential)

What you could do is have the backend App request a token from B2C using its own identity (client credentials flow) - this was not previously possible with B2C but is now in preview
https://learn.microsoft.com/en-us/azure/active-directory-b2c/client-credentials-grant-flow?pivots=b2c-custom-policy