0

I have been playing with Microsoft.Identity platform and trying to get it to work with the basic templates in aspnetcore 6.0, but I get stuck in an infinite login loop.

I am using projects created from the templates for web app and web api (using these commands "dotnet new webapi --force --auth IndividualB2C" and "dotnet new webapp --force --auth IndividualB2C") and then updated the appsettings in both to connect to my Azure B2C tenant.

WEB APP

"AzureAdB2C": {
        "CallbackPath": "/signin-oidc",
        "ClientId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
        "ClientSecret": "xxxxx",
        "Domain": "xxxx.onmicrosoft.com",
        "EditProfilePolicyId": "B2C_1_EditProfile",
        "Instance": "https://xxxx.b2clogin.com/",
        "SignedOutCallbackPath": "/signout/B2C_1_susi",
        "SignUpSignInPolicyId": "B2C_1_SUSI"
    },
    "DownstreamApi": {
        "BaseUrl": "https://localhost:7208/",
        "Scopes": "https://xxxx.onmicrosoft.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/user.impersonation"
    }

WEB API

"AzureAdB2C": {
    "ClientId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "Domain": "xxxx.onmicrosoft.com",
    "Instance": "https://xxxx.b2clogin.com/",
    "Scopes": "https://xxxx.onmicrosoft.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/user.impersonation"
    "SignUpSignInPolicyId": "B2C_1_SUSI"
}

After making these changes, I can run the applications and the Web App will attempt to login in through my social accounts then go into an infinite loop redirecting between the login server and the app redirect Url.

I do get a log message that MicrosoftIdentityWebChallengeUserException was thrown (presumably because I need to consent to the scopes). My understanding is that the [AuthorizeForScopes(ScopeKeySection = "DownstreamApi:Scopes")] attribute on the Razor page should handle this consent workflow for me, but it doesn't seem to be doing that.

Is there something additional I need to do in configuring these sample applications or a way to trap the WebChallenge exception (and if so, how do I issue the challenge back to the user)?

I feel like I am missing something obvious here to get this to work, but I cannot seem to find it. Can anyone provide some guidance to get this to work?

1 Answer 1

0

Please check if this can narrow down the issue:

  1. Please clear cookies and try again.

  2. AuthorizeForScopes attribute needs the exact scopes in that method. Any incorrect scopes there will result in MsalUiRequiredException . Try hardcoding the parameters to whatever scopes are required : [AuthorizeForScopes(Scopes = new[] { "User.impersonation”})]

  3. Try using IExceptionFilter And add filter in Startup.cs as follows:

services.AddMvc(options =>
    {
        var policy = new AuthorizationPolicyBuilder()
            .RequireAuthenticatedUser()
            .Build();
        options.Filters.Add(new AuthorizeFilter(policy));
        options.Filters.Add(new AuthorizeForScopesAttribute(new string[] { Scopes:[] }));
    })

Please checkout this SO reference

Reference:

active-directory-aspnetcore issues | github

1
  • Thanks for the feedback and suggestions, but none of these solved the loop. I do get a different error if I change the defined scope to 'user.impersonation' (Scope not supported or similar message) ... but all of these continue to run the loop.
    – Jerry Esch
    Dec 10, 2021 at 14:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.