5

I followed this resource: https://REDACTED.b2clogin.com/REDACTED.onmicrosoft.com/B2C_1A_DEMO_CLIENTCREDENTIALSFLOW/oauth2/v2.0/token

  • Azure B2C App registrations:
    • Protected web api
      • Expose an api
        • App ID URI = https://{my tenant name}.onmicrosoft.com/{protected web api client id}/.default
    • Daemon console app
      • API Permissions
        • API = protected web api
          • Permission = access_as_application
          • Type = Application
          • Admin consent requested = Yes

I acquire a token using the OAuth client credentials flow:

POST https://{my tenant name}.b2clogin.com/{my tenant name}.onmicrosoft.com/{a basic user flow SUSI policy}/oauth2/v2.0/token

scope=https://REDACTED.onmicrosoft.com/{protected web api client id}/.default&
grant_type=client_credentials&
client_id={daemon console app client id}&
client_secret={daemon console app client secret}

Error response:

{
    "error": "invalid_grant",
    "error_description": "AADB2C90085: The service has encountered an internal error. Please reauthenticate and try again.\r\nCorrelation ID: REDACTED\r\nTimestamp: REDACTED\r\n"
}
0

5 Answers 5

6

I ran into the same issue, please double check your Manifest and make sure that "signInAudience": "AzureADandPersonalMicrosoftAccount" and not your organization only. Do also ensure you followed the steps same as other answer.

2
  • this solved my issue. i first changed this value in web api manifest, it did not work. After that, i updated this value in my client app, it worked. Commented Aug 23, 2022 at 16:48
  • For me, I tried to use the web api as same as my api for client credentila and I have "signInAudience": "AzureADMyOrg". However, its not working and saying the same invalid_grant Commented Sep 30, 2023 at 2:27
3

For me, my secrets expired. replacing them with new ones fixed it for me.

3

TL;DR: Don't use the AzureB2C token URL that includes the user policy, but the generic AzureB2C token URL.

As stated in the answer of user1932923, you could set the signInAudience to AzureADandPersonalMicrosoftAccount. But setting the signInAudience to AzureADandPersonalMicrosoftAccount might not be what you want, as for example it limits the number of client-secrets to 2, as documented here: https://learn.microsoft.com/en-us/azure/active-directory/develop/supported-accounts-validation.

The deeper problem is that you are using the wrong AzureB2C token URL, which includes the user policy:

https://{my tenant name}.b2clogin.com/{my tenant name}.onmicrosoft.com/{a basic user flow SUSI policy}/oauth2/v2.0/token

Given that you are using the client-credential flow to obtain a token from the app-registration, it is better to use the generic AzureB2C token URL. This is the token URL of the underlying Azure AD (Entra ID) instance.

You can find an overview of all the endpoints, including the generic endpoints without the user policy, in the Azure Portal. In the Azure Portal, open up AzureB2C and then: AzureB2C > App Registrations > Endpoints (on top of the page). What you need to look for are the Microsoft Entra endpoints: 
Endpoints

Or just by navigating to the 'Microsoft Entra ID' and using the information found there.

By using that generic AzureB2C token endpoint URL, you will be able to create an app-registration with for example 'Accounts in this organizational directory only', from which you can get a token via the client-credentials flow without facing the invalid_grant error.

7
  • nope. This won't work you will face an issue with issuer is invalid as the b2c issuer is your b2c domain whereas generic token endpoint is login.microsoftonline.com. second suppose you avoid that, you will face audience followed by sign-in key issue. Commented Sep 30, 2023 at 2:25
  • @BrijeshShah, when you use the generic Idp endpoint, you should indeed consider it as a different Idp. The issuer in the token will therefore indeed be login.microsoft.com{unique-id}, and it will use a different signing key (as described also on the well-known endpoint). It comes down to pointing your app to a different Idp for the incoming requests. I assume you refer to the issue when the same application endpoint accepts both AzureB2C user and app-registration tokens, but that is a design choice and the OP's question did not specify anything about authenticating users. Commented Oct 2, 2023 at 9:28
  • @MartijnEvens What is the format of this generic B2C token endpoint? I do not see it listed in the portal. Commented Oct 17, 2023 at 20:50
  • @DonnyKwitty, I've edited my answer and provided a screenshot. Hopefully that helps to find it in the Azure Portal. The format of the B2C token endpoint you are looking for is https://login.microsoftonline.com/<guid>/oauth2/v2.0/token. Commented Oct 23, 2023 at 14:37
  • @MartijnEvens Thanks. But that is not a B2C endpoint. My own issue was solved by using only lower-case letters for the user-flow in the URL. Commented Oct 24, 2023 at 15:27
0

Your user flow name you use in the token endpoint MUST BE IN LOWER CASE. Otherwise, you will see this error.

0

In my case this error was caused by having the same redirect URIs set in both of my app registrations in Azure AD B2C.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.