Azure B2C Custom Policies obtain Bearer token

CH Vamsi Krishna 0

I am using Azure B2C Custom policies for Login and SSPR (password) already and I got a new requirement that It should invoke a REST API call (microservice) which is hosted in Azure(APIM) and I have implemented a REST Technical profile which can connect with APIM URL however it(APIM or REST API) expects Bearer / AccessToken.

I am looking for another technical profile which can take below details such as client id, secret,& Resource id and generates bearer token so that I can call the APIM URL with the bearer token
https://login.microsoftonline.com/tenantid-531f-4f14-9af1-dc7b444c3ad8/oauth2/token
grant_type:client_credentials

client_id:sdf-c41a-43ab-bb11-e73259dbd33f

client_secret:sdf~3aKoyO3Vg-sdf

resource:df-00f5-4d7b-b1e2-313aba71fe8e

or do you think is there any better way like Azure b2c custom policy -> call APIM -> APIM should generate token-> Rest API (microservice)

Suggest your thoughts

I am using this now but not working

1 answer

James Hamil 26,881 Reputation points Microsoft Employee

2025-01-02T23:02:07.5933333+00:00

Hi @CH Vamsi Krishna , you can use the REST-AcquireAccessToken technical profile to obtain an access token using the client credentials flow. This technical profile will generate an access token that can be used to call your REST API.

You can then use the bearerToken output claim in your REST technical profile to call your REST API.

More information here: https://stackoverflow.com/questions/69507949/how-to-get-oauth2-bearer-access-token-in-b2c-custom-policy-to-send-claims-to-my

You can also use Azure APIM to generate the access token for you. You can configure APIM to use Azure AD as the authentication provider and then use the openid scope.

Please let me know if you have any questions and I can help you further.

Best,

James
Please sign in to rate this answer.

1 person found this answer helpful.
CH Vamsi Krishna 0 Reputation points

2025-01-06T19:17:37.41+00:00

thanks James Hamil however I have able to achieve this differently as below

Create a Technical Profile for getting Bearer or Access_Token in the below .

<TechnicalProfile Id="OAuth2BearerToken"> <DisplayName>Get OAuth Bearer Token</DisplayName> <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" /> <Metadata> <Item Key="ServiceUrl">https://login.microsoftonline.com/<YourTeanantId>/oauth2/token</Item> <Item Key="HttpMethod">POST</Item> <Item Key="AuthenticationType">None</Item> <Item Key="HttpBinding">POST</Item> <Item Key="SendClaimsIn">Form</Item> <Item Key="Content-Type">application/x-www-form-urlencoded</Item> </Metadata> <InputClaims> <InputClaim ClaimTypeReferenceId="client_id" PartnerClaimType="client_id" DefaultValue="Your_Client_Id" AlwaysUseDefaultValue="true" /> <InputClaim ClaimTypeReferenceId="client_secret" PartnerClaimType="client_secret" DefaultValue="Your_Client_Secret" AlwaysUseDefaultValue="true" /> <InputClaim ClaimTypeReferenceId="resource" PartnerClaimType="resource" DefaultValue="resource id (Optional)" AlwaysUseDefaultValue="true" /> <InputClaim ClaimTypeReferenceId="grant_type" PartnerClaimType="grant_type" DefaultValue="client_credentials" AlwaysUseDefaultValue="true" /> </InputClaims> <OutputClaims> <OutputClaim ClaimTypeReferenceId="bearerToken" PartnerClaimType="access_token" DefaultValue="default token" /> </OutputClaims> <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" /> </TechnicalProfile>

Define Claims Types under the Claim schema as below . You can try by providing the values here or in the Technical profile as well it is upto you.

<ClaimType Id="client_id"> <DisplayName>Client ID</DisplayName> <DataType>string</DataType> <DefaultPartnerClaimTypes> <Protocol Name="OAuth2" PartnerClaimType="client_id" /> </DefaultPartnerClaimTypes> </ClaimType> <ClaimType Id="client_secret"> <DisplayName>Client secret</DisplayName> <DataType>string</DataType> <DefaultPartnerClaimTypes> <Protocol Name="OAuth2" PartnerClaimType="client_secret" /> </DefaultPartnerClaimTypes> </ClaimType>

Use this Technical profile during your Orchestration Journey as below

<OrchestrationStep Order="1" Type="ClaimsExchange"> <ClaimsExchanges> <ClaimsExchange Id="GetBearerToken" TechnicalProfileReferenceId="OAuth2BearerToken" />

Givary-MSFT 34,866 Reputation points Microsoft Employee

2025-01-09T07:03:24.42+00:00

@CH Vamsi Krishna Thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

If you have any other questions or are still running into more issues, please let me know. Thank you again for your time and patience throughout this issue.

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure B2C Custom Policies obtain Bearer token

1 answer

Your answer