We have a 3rd party vendor trying to use our API's. Our API's are protected and are using AD B2C. How can I get a token and use it for authentication? Is there any documentation (or) sample apps for it? Can someone share some info on it?

Hi @Edenred-6642, Thanks for reaching out and apologies for delay in response. I understand that you are looking for samples to call protected Web API secured using Azure AD B2C. To call the web API secured using Azure AD B2C, 3rd party vendor’s application also need to register in Azure AD B2C. To get the valid access token issued by Azure AD B2C, all the users of third-party vendor need to authenticate with Azure AD B2C with required permission. Further, Pass the token as ‘Bearer Token’ in authorization header which validates the token and permissions to access your protected web API. Refer the below samples based on your scenario to call web API protected by Azure AD B2C. https://learn.microsoft.com/en-us/azure/active-directory-b2c/enable-authentication-web-api?tabs=csharpclient https://learn.microsoft.com/en-us/azure/active-directory-b2c/integrate-with-app-code-samples#web-apps-and-apis Thanks, Shweta ------------------------------------------------------------ Please remember to " Accept Answer " if answer helped you.

B2C Token for 3rd Party Vendors

Accepted answer

Shweta Mathur 29,751 Reputation points Microsoft Employee

2022-02-28T10:29:53.283+00:00
Hi @Edenred-6642,

Thanks for reaching out and apologies for delay in response.

I understand that you are looking for samples to call protected Web API secured using Azure AD B2C.

To call the web API secured using Azure AD B2C, 3rd party vendor’s application also need to register in Azure AD B2C.

To get the valid access token issued by Azure AD B2C, all the users of third-party vendor need to authenticate with Azure AD B2C with required permission.

Further, Pass the token as ‘Bearer Token’ in authorization header which validates the token and permissions to access your protected web API.

Refer the below samples based on your scenario to call web API protected by Azure AD B2C.

https://learn.microsoft.com/en-us/azure/active-directory-b2c/enable-authentication-web-api?tabs=csharpclient
https://learn.microsoft.com/en-us/azure/active-directory-b2c/integrate-with-app-code-samples#web-apps-and-apis

Thanks,
Shweta

------------------------------------------------------------

Please remember to "Accept Answer" if answer helped you.
Please sign in to rate this answer.
skhsjdksjdn-6642 41 Reputation points

2022-02-28T21:04:03.673+00:00

Thank you for sharing that info. I'm looking for a Service/Daemon type of user account and getting the access token for it. I have authentication already built using AD B2C for the API's. That is working fine. Now, I would like a service account to call the B2C API's with that access token. Was wondering what's the best way to call it?

Shweta Mathur 29,751 Reputation points Microsoft Employee

2022-03-02T05:52:15.417+00:00

Hi @Edenred-6642 ,

Thanks for the update.

Service/Daemon accounts that run without the user interaction can authenticate by using OAuth 2.0 client credentials flow.

Although, the OAuth 2.0 client credentials grant flow is not currently directly supported by the Azure AD B2C as mentioned here , you can set up client credentials flow using Azure AD and the Microsoft identity platform endpoint for an application in your Azure AD B2C tenant.

Refer the blog on how to achieve the client credentials grant flow in Azure B2C: https://www.hossambarakat.net/2020/08/14/azure-b2c-client-credentials/

Thanks,
Shweta

skhsjdksjdn-6642 41 Reputation points

2022-03-02T16:12:16.32+00:00

Thank you @Shweta Mathur for your response. I tried the link you have shared. Was able to generate the token but running into issues with scopes, 401 errors while validating the token. We are using MSAL for B2C authentication. Was able to make it work with new app registration in "Azure AD" and validating that token in web api's too using multiple authentication schemes. https://github.com/AzureAD/microsoft-identity-web/wiki/Web-APIs#using-multiple-authentication-schemes

Shweta Mathur 29,751 Reputation points Microsoft Employee

2022-03-03T11:10:01.013+00:00

Hi @Edenred-6642 ,

In client credential flow as there is server to server interaction, server application need to grant the app Role as an application permission to the client application.

To do that first, you need to expose the api of the server application protected by Azure

Azure portal>App registrations>Expose an API> set the application id URI

Then you need to create the appRole of the server application, and then grant that role as an application permission to the client application.

Next, go to client application>API permissions>Add a permission>My APIs>your api application.

and grant admin consent to the permissions

Now get the access token with client credential flow using

You will get the token with application roles to call the web API . You can validate access token using jwt.ms.

Hope this will help.
Thanks,
Shweta
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

B2C Token for 3rd Party Vendors

0 additional answers

Your answer