Azure B2C Userinfo Endpoint 401 Error

Question

Azure B2C Userinfo Endpoint 401 Error

RPD 0

When passing an ID token or access token to the Azure B2C userinfo endpoint, a 401 error is thrown. I followed the steps in the userinfo article and created a custom policy using this sample. I registered a web application and created a Userinfo endpoint with the custom policy. When I pass the AccessToken from the web application to the userinfo endpoint, it fails with a 401 error. However, when I run the custom userinfo policy with the web application Id in the Azure Portal, I get the ID token, and this token works with the userinfo endpoint. If I generate a token with a different user flow with the web application Id and pass it to the userinfo endpoint, it throws a 401 error. Am I missing something here?

Shweta Mathur 30,471 Reputation points Microsoft Employee Moderator

2023-10-17T08:01:13.0066667+00:00

Hi @RPD ,

Thanks for reaching out.

Based on the information you provided, it seems like the access token you are passing to the userinfo endpoint is not valid. The 401 error indicates that the access token is not authorized to access the userinfo endpoint.

Could you please verify the issuer you passed is in lowercase and correctly configured. If you are passing audience, validate its value as well.

Did you try to decode the access token using jwt.ms to check valid issuer and audience.

For further troubleshooting, you can configure ApplicationInsights to check traces for Azure B2C.

Thanks,

Shweta

RPD 0

Hi @Shweta Mathur Thank you for the response

The issuer is in all lowercase and token is decoded with the issuer and audience

I have given only one audience which is app (TestApp), If I run any default userflow using this app and pass the token to userinfo its not authenticating.

If i run the userinfo RP using the same app (TestApp) and generate token, this is getting validated.

I want to use recommended default flows for the user and just use custom policy for the userinfo endpoint. This should work ?

Userinfo token

{
  "ver": "1.0",
  "iss": "https://xxxxxx.b2clogin.com/ xxxxxx-xxxxxx -4c28-adb5- xxxxxx/v2.0/",
  "sub": "xxxxxx",
  "aud": "xxxxxxxxc58",
  "exp": 1697557516,
  "acr": "b2c_1a_demo_signup_signin_userinfo",
  "nonce": "defaultNonce",
  "iat": 1697553916,
  "auth_time": 1697553916,
  "name": "Test",
  "given_name": "Test",
  "family_name": "Test",
  "tid": "584bc793-7e80-4c28-adb5-xxxxxx",
  "nbf": 123221321
}

Default signin flow token

{
  "ver": "1.0",
  "iss": "https://xxxxx.b2clogin.com/xxxxx-xxxxx/v2.0/",
  "sub": "xxxxxxxx",
  "aud": " xxxxxxxxc58",
  "exp": 1697557470,
  "nonce": "defaultNonce",
  "iat": 1697553870,
  "auth_time": 1697553870,
  "city": "Test",
  "given_name": "Test",
  "family_name": "Daniel",
  "Test": [
    "******@gmail.com"
  ],
  "tfp": "B2C_1_SignIn",
  "nbf": 1691231270
}

1 answer

Your answer

Shweta Mathur 30,471 Reputation points Microsoft Employee Moderator

2023-10-17T08:01:13.0066667+00:00

Hi @RPD ,

Thanks for reaching out.

Based on the information you provided, it seems like the access token you are passing to the userinfo endpoint is not valid. The 401 error indicates that the access token is not authorized to access the userinfo endpoint.

Could you please verify the issuer you passed is in lowercase and correctly configured. If you are passing audience, validate its value as well.

Did you try to decode the access token using jwt.ms to check valid issuer and audience.

For further troubleshooting, you can configure ApplicationInsights to check traces for Azure B2C.

Thanks,

Shweta
RPD 0 Reputation points

2023-10-17T15:14:40.0066667+00:00

Hi @Shweta Mathur Thank you for the response

The issuer is in all lowercase and token is decoded with the issuer and audience

I have given only one audience which is app (TestApp), If I run any default userflow using this app and pass the token to userinfo its not authenticating.

If i run the userinfo RP using the same app (TestApp) and generate token, this is getting validated.

I want to use recommended default flows for the user and just use custom policy for the userinfo endpoint. This should work ?

Userinfo token

{ "ver": "1.0", "iss": "https://xxxxxx.b2clogin.com/ xxxxxx-xxxxxx -4c28-adb5- xxxxxx/v2.0/", "sub": "xxxxxx", "aud": "xxxxxxxxc58", "exp": 1697557516, "acr": "b2c_1a_demo_signup_signin_userinfo", "nonce": "defaultNonce", "iat": 1697553916, "auth_time": 1697553916, "name": "Test", "given_name": "Test", "family_name": "Test", "tid": "584bc793-7e80-4c28-adb5-xxxxxx", "nbf": 123221321 }

Default signin flow token

{ "ver": "1.0", "iss": "https://xxxxx.b2clogin.com/xxxxx-xxxxx/v2.0/", "sub": "xxxxxxxx", "aud": " xxxxxxxxc58", "exp": 1697557470, "nonce": "defaultNonce", "iat": 1697553870, "auth_time": 1697553870, "city": "Test", "given_name": "Test", "family_name": "Daniel", "Test": [ "******@gmail.com" ], "tfp": "B2C_1_SignIn", "nbf": 1691231270 }

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more