Azure / Azure/static-web-apps

PKCE code_challenge required for custom authentication provider (B2C)

Open
#640 15 comments 2 reactions 0 assignees View on GitHub
AuthN/Z
Dominant language
No language data
Stars
346
Forks
67
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**

The following error is presented when trying to use Static Web App authentication with Azure B2C as an OpenID Connect provider.

```
Correlation ID: bfd441e2-7174-4f95-8e3b-179a009aa86e
Timestamp: 2021-11-23 08:43:51Z
AADB2C99059: The supplied request must present a code_challenge
```

A clear and concise description of what the bug is.

**To Reproduce**

I've followed the directions [here](https://docs.microsoft.com/en-us/azure/static-web-apps/authentication-custom?tabs=openid-connect) for creating a custom OpenID Connect authentication provider and the flows seem to be working until the point at which it hits B2C.

Steps to reproduce the behavior:
1. Create an Azure Static Web App
2. Create an Azure B2C Tenant with App registration and add redirect urls to the callback urls as per the above documentation
3. Use the b2c configuration declared in the attached `staticwebsites.config.json`
4. Create a React App
5. Have the React App call the login flow with a link to `/.auth/login/b2c?post_login_redirect_uri=${window.location.pathname}`
6. The attached error is displayed

note: B2C is correctly configured with app secrets and redirect urls, the app secrets are configured in the Azure Static Web App application configuration section. I've confirmed these are correct by changing them to invalid ones at which point I receive a different error.

**Expected behavior**

I expect that the authentication request would be accepted by B2C and the user flow would progress as normal.

**Screenshots**

![image](https://user-images.githubusercontent.com/610688/142994974-a580fe4e-4f04-4426-80a6-c279f865af76.png)

**staticwebapp.config.json**

```
{
"navigationFallback": {
"rewrite": "/index.html",
"exclude": [
"*.{css,scss,js,png,gif,ico,jpg,svg}"
]
},
"auth": {
"identityProviders": {
"customOpenIdConnectProviders": {
"b2c": {
"registration": {
"clientIdSettingName": "B2C_CLIENT_ID",
"clientCredential": {
"clientSecretSettingName": "B2C_CLIENT_SECRET"
},
"openIdConnectConfiguration": {
"wellKnownOpenIdConfiguration": "https://redacted.b2clogin.com/redacted.onmicrosoft.com/B2C_1_SUSI/v2.0/.well-known/openid-configuration"
}
},
"login": {
"nameClaimType": "emails",
"scopes": ["openid", "profile"]
}
}
}
}
}
}

```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.