Scope for multiple web apis

Question

I have 2 web apis (A and B) on my b2c. Each one of them publishes their own permissions respectively (scopeA1, scopeA2) and (scopeB1, scopeB2).

On my web application (which already configured and have granted access permission on both apis and the 4 scopes), in order to get authorization code for both apis during authentication, I tried to set my OpenIdConnectAuthenticationOptionsin scope property to include the 4 scopes. I got an error AADB2C90146: The scope 'scopeA1 scopeA2 scopeB1 scopeB2 openid offline_access' provided in request specifies more than one resource for an access token, which is not supported.

While if I specify only scopes for web api A or B, then it works as per this link

How can I get my web app to use both web apis even with granted permissions for both

Thanks for help

Answer 1

If the two web APIs are separate applications in Azure AD, then you need to request access tokens separately for them.

I'm not familiar with the sample you used as a starting point, but it looks like these lines are where you need to make your change:

// Retrieve the token using the provided scopes
ConfidentialClientApplication app = new ConfidentialClientApplication(authority, Startup.ClientId,
                                    Startup.RedirectUri, credential,
                                    new NaiveSessionCache(userObjectID, this.HttpContext));
AuthenticationResult result = await app.AcquireTokenSilentAsync(scope);

accessToken = result.Token;

You should create an app instance for each of your APIs, and acquire a token for each of them. Then, when you call the APIs somewhere else, use the correct access token in the Bearer authentication header.

Answer 2

I had the same issue and asked a similar question Extend MSAL to support multiple Web APIs

but i have not had an answer, basically to get around it in the short term i have made both my API's use the same authorization client ID + secret and therefore I can reuse the same scopes accross my APIS

its not what i want but if you want to use Azure AD B2C you need to get used to compromising for a while until the support is there

-- I would also say you are using an older version of MSAL which i am also using, im waiting until the version 1 release before upgrading again.

The github talks about using this format

https://github.com/AzureAD/microsoft-authentication-library-for-dotnet

Step 1: Add MSAL to your Solution/Project
Right click on your project > Manage packages.
Select include prerelease > search msal.
Select the Microsoft.Identity.Client package > install.

Step 2: Instantiate MSAL and Acquire a Token
Create a new PublicClientApplication instance. Make sure to fill in your 
app/client id
PublicClientApplication myApp = new PublicClientApplication(CLIENT_ID);
Acquire a token
AuthenticationResult authenticationResult = await 
myApp.AcquireTokenAsync(SCOPES).ConfigureAwait(false);

Step 3: Use the token!
The access token can now be used in an HTTP Bearer request.