Azure B2C Authentication with PHP

Question

Azure B2C Authentication with PHP

House of Giants, LLC 21

Hi there!

We have a PHP application built on the Zend Framework that we'd like to integrate with Azure B2C for user authentication.

I have my application registered in by B2C tenant, and I planned on using OAuth to redirect a user, and grab tokens once they're logged in. However, I'm looking for code examples (of which I can only find a few) and the main one appears to be deprecated - https://github.com/Azure-Samples/active-directory-php-graphapi-web/tree/archive

I'm assuming it's because it's using Azure AD V1.0.. however, is there some reason I'm not finding that I shouldn't use PHP to do the authentication/redirection? Do I instead need to use Javascript and MSAL.js, and then pass the token back from the client to my server?

Any guidance, suggestions, tips, etc. would be much appreciated!

JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2021-03-24T00:19:09.51+00:00

@House of Giants, LLC
Thank you for your post and I apologize for the delayed response!

When it comes to B2C authentication documentation I was able to find another GitHub sample - PHP Web Application with Azure AD B2C, that might help with your issue.

Additional Link:
How to validate Azure ad b2c token using PHP?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
House of Giants, LLC 21 Reputation points

2021-03-24T02:01:20.313+00:00

@JamesTran-MSFT -
I am making an authentication call to the endpoint:
https://tenant.b2clogin.com/tenant.onmicrosoft.com/B2C_1_signin/oauth2/v2.0/authorize?response_type=code&response_mode=form_post&client_id=client_id&redirect_uri=redirect&scope=openid%20offline_access&state=user

I'm requesting a code back which returns an id_token with Claims. This id_token doesn't have groups that I enabled in App Manifest - groupMembershipClaims: SecurityGroup

I use that code to make a request to the /token endpoint with grant_type=authorization_code

This is returning id_token, not an access_token, and also not returning the groups claim. I have Access and ID Tokens enabled in my App.

How can I return groups or get an access_token so I can make a request to Graph API, if groups are not returned?

3 answers

Your answer

JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2021-03-24T00:19:09.51+00:00

@House of Giants, LLC
Thank you for your post and I apologize for the delayed response!

When it comes to B2C authentication documentation I was able to find another GitHub sample - PHP Web Application with Azure AD B2C, that might help with your issue.

Additional Link:
How to validate Azure ad b2c token using PHP?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
House of Giants, LLC 21 Reputation points

2021-03-24T02:01:20.313+00:00

@JamesTran-MSFT -
I am making an authentication call to the endpoint:
https://tenant.b2clogin.com/tenant.onmicrosoft.com/B2C_1_signin/oauth2/v2.0/authorize?response_type=code&response_mode=form_post&client_id=client_id&redirect_uri=redirect&scope=openid%20offline_access&state=user

I'm requesting a code back which returns an id_token with Claims. This id_token doesn't have groups that I enabled in App Manifest - groupMembershipClaims: SecurityGroup

I use that code to make a request to the /token endpoint with grant_type=authorization_code

This is returning id_token, not an access_token, and also not returning the groups claim. I have Access and ID Tokens enabled in my App.

How can I return groups or get an access_token so I can make a request to Graph API, if groups are not returned?

Answer 1

JamesTran-MSFT 36,906 Microsoft Employee Moderator

@House of Giants, LLC
Thank you for the quick follow up on this!

When it comes to getting an access token within Azure B2C, you first need to get an authorization code. Below is an example of a request to the /authorize endpoint for an authorization code. Custom domains are not supported for use with access tokens. Use your tenant-name.onmicrosoft.com domain in the request URL. For more info - Request a token

GET https://<tenant-name>.b2clogin.com/<tenant-name>.onmicrosoft.com/<policy-name>/oauth2/v2.0/authorize?  
client_id=<application-ID>  
&nonce=anyRandomValue  
&redirect_uri=https://jwt.ms  
&scope=https://<tenant-name>.onmicrosoft.com/api/read  
&response_type=code

After successfully receiving the authorization code, you can use it to request an access token:

POST <tenant-name>.b2clogin.com/<tenant-name>.onmicrosoft.com/<policy-name>/oauth2/v2.0/token HTTP/1.1  
Host: <tenant-name>.b2clogin.com  
Content-Type: application/x-www-form-urlencoded  
  
grant_type=authorization_code  
&client_id=<application-ID>  
&scope=https://<tenant-name>.onmicrosoft.com/api/read  
&code=eyJraWQiOiJjcGltY29yZV8wOTI1MjAxNSIsInZlciI6IjEuMC...  
&redirect_uri=https://jwt.ms  
&client_secret=2hMG2-_:y12n10vwH...

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

House of Giants, LLC 21 Reputation points

2021-03-24T19:18:28.36+00:00

Hi @JamesTran-MSFT -

I am requesting a code, which I am receiving, and I am sending to the /token endpoint. I am not receiving an access_token from that endpoint. I am only receiving an id_token...
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2021-03-24T20:02:35.6+00:00

@House of Giants, LLC
Thank you for the quick response!

I've reached out to our engineering team regarding this and will update as soon as possible.

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
House of Giants, LLC 21 Reputation points

2021-03-24T20:15:45.007+00:00

Hi @JamesTran-MSFT , I do have an open ticket regarding these issues, but I haven't heard back from them as of yet. I'm trying to escalate this so I can get it resolved sooner than later! If you can assist with escalating, that would be wonderful.
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2021-03-25T22:57:29.74+00:00

@House of Giants, LLC
Thank you for the quick response! Are you able to share your support request number?

Answer 2

JamesTran-MSFT 36,906 Microsoft Employee Moderator

@House of Giants, LLC
I also worked with my team on this, and we were able to get the auth-code grant flow working for B2C, I'll post the steps below.

Request to /authorize endpoint:   
GET https://<B2C-tenant-name>.b2clogin.com/<B2C-tenant-name>.onmicrosoft.com/<policy-name>/oauth2/v2.0/authorize?client_id=<client-id>&response_type=code&redirect_uri=http://jwt.ms&response_mode=fragment&scope=<client-id>%20offline_access&state=1234  
  
Note: The above request will only return a code as fragment in the browser address bar and no id token would be returned.  
  
  
Request to /token endpoint:  
POST https://<B2C-tenant-name>.b2clogin.com/<B2C-tenant-name>.onmicrosoft.com/<policy-name>/oauth2/v2.0/token  
    
Header: Content-Type:application/x-www-form-urlencoded  
Body:  
grant_type:authorization_code  
client_id:<client-id>  
client_secret:<client-secret>  
redirect_uri:https://jwt.ms  
scope:<client-id> offline_access  
code: <code received from the above request>  
  
Note: Call to the token endpoint should return all the three tokens access_token, id_token and refresh_token.

Can you also try doing these calls without PHP (i.e. through Postman) and see if you can fetch the tokens?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

House of Giants, LLC 21 Reputation points

2021-03-25T23:09:04.397+00:00

Hey @JamesTran-MSFT

My ticket # is 2103180010002955.

I also didn't have https://jwt.ms in my redirect URLs - trying the above now, and I'm getting the code returned into my local app url as -

https://localhost/Painel/login#state=user&code=<code_here>

I'm using the code to make a Postman request to the /token endpoint, and I am successfully getting an access_token! (and I swear I did it exactly this way before...) However, I am unable to use this access token to access the Graph API.

As I understand it, I need to make a call to https://graph.microsoft.com/v1.0/users/<user_id with Header - Authorization: Bearer <access_token> to get the user's assigned Azure AD groups, since this is not set back in as a claim on the initial id_token, access_token or refresh_token.
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2021-03-26T20:27:51.397+00:00
@House of Giants, LLC
Thank you for the quick update on this and I'm glad that you were able to get the access token!

You mentioned you can't use it to access the GraphAPI, are you receiving an error message?

What API are you specifically trying to call? The get user API?

When it comes to getting AzureAD groups you should be able to use the - List members API since it gets a list of the group's direct members. I wasn't able to find an output of groups within the /user call you are referring to.

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2021-03-29T21:12:27.827+00:00

@House of Giants, LLC
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

I did some more research and if you're trying to use the access token for GraphAPI calls from/to your B2C tenant, keep in mind that you'll have to leverage the supported B2C GraphAPI operations, since not all GraphAPI calls are supported for both AzureAD and B2C.

Additional link:
https://stackoverflow.com/questions/66806035/update-user-in-ad-b2c-using-microsoft-graph-api-error-400-bad-request/66817136#66817136

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
House of Giants, LLC 21 Reputation points

2021-03-30T22:12:29.1+00:00

@JamesTran-MSFT - I was trying to use the access_token returned from the logged in user rather than a client_id and client_secret generated access_token, that would give me access to an app that had Graph API permissions and would act as the "administrator" user. Getting an access token from that endpoint, I was able to use the token to access Graph.

I do have one more questions - I am struggling to verify the access_token within PHP. There doesn't seem to be a good library to do so... Am I correct in assuming that the access_token is created via OpenSSL? So it needs to be decrypted using the jwks_uri endpoint to grab the public key? Do you have any recommendations on best practices for decrypting and validating signatures/jwt tokens in PHP?

Answer 3

JamesTran-MSFT 36,906 Microsoft Employee Moderator

@House of Giants, LLC

When it comes to Access tokens with Azure, this is a security token that's issued by an authorization server as part of an OAuth 2.0 flow. The Microsoft identity platform implements security tokens as JSON Web Tokens (JWTs) that contain claims. Since JWTs are used as security tokens, this form of authentication is sometimes called JWT authentication.

When it comes to decrypting JWT tokens in general (I haven't tested with PHP), you should be able to leverage - https://jwt.ms/ - For more info.

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Shaden 1 Reputation point

2021-05-29T01:19:09.927+00:00

@JamesTran-MSFT
You made it look so easy.
But the real problem is validating the token signature.
as Per MS Docs " To verify the tokens from Azure AD B2C, you need to generate the public key using the exponent(e) and modulus(n). You need to determine how to do this in your respective programming language accordingly. The official documentation on Public Key generation with the RSA protocol can be found here: https://tools.ietf.org/html/rfc3447#section-3.1 "

in this link :https://learn.microsoft.com/en-us/azure/active-directory-b2c/openid-connect#get-a-token

if you have done it in PHP , please share a snippet of the code .

the only code in GitHub has been deprecated and does not work on PHP 8 or 7.

Share via

Azure B2C Authentication with PHP

3 answers

Your answer