Share via

Scope are not supported while getting authCodeUrl with protocol mode OIDC

Anonymous
2025-04-11T06:01:26.67+00:00

CIAM: Azure AD B2C

Library: MSAL NodeI
I am migrating from client secret to federated credential with AKS. Therefore, I have to change the default AAD protocol to OIDC.

this.client = new ConfidentialClientApplication({
            auth: {
                clientId: configuration.clientId,
                authority: this.signInSignUpAuthority,
                knownAuthorities: [`https://${authorityDomain}`],
                protocolMode: `OIDC`,
                clientAssertion: `${clientAssertionValue}`
            }
        });

Unfortunaely, it does not work while getting AuthCodeUrl. I am stuck and did not find what is the problem here.

result = await this.client.getAuthCodeUrl({
                authority: authority,
                redirectUri: this.configuration.baseRedirectUri + 'auth/' + ActionPathname.REDIRECT,
                scopes: this.configuration.scopes,
                codeChallenge: challenge,
                codeChallengeMethod: 'S256',
                state: state ?? undefined
            });

Both openid and offline_Access scopes are added to App in the App registration.Screenshot 2025-03-27 at 11.27.33

error: invalid_request

**error_description:**AADB2C90012: The scope 'openid profile offline_access' provided in request is not supported.

state: {"target":"https://localhost:3000/","appStage":0}

Microsoft Security | Microsoft Entra | Microsoft Entra External ID

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.