Forum Discussion

ranjithreddy976's avatar
ranjithreddy976
Copper Contributor
Sep 11, 2023

ZAP Scan Automation using Azure DevOps

Hey Team,

 

I have implemented ZAP Scan for one of the microservices. I need to get the access token from the Azure AD B2C using client assertion for the microservice. I have registered my application under the Azure AD B2C, to generate the client assertion which technique should I follow(like MSAL) or any insights from your end.

 

Are there any other approach to get the access token from Azure AD B2C or Azure AD B2E with out passing the client secret.

If there is a solution how I need to automate the whole process using the powershell or python. Please share your valid thoughts.

 

Thank you for your patience.

azure devops

1 Reply

  • Kidd_Ip's avatar
    Kidd_Ip
    MVP
    Aug 05, 2025

    Try Clietn Credential Flow + Client Assertion:

     

    1. Register a certificate with your Azure AD B2C application
    2. Generate a signed JWT as the client assertion
    3. Request a token using this assertion

    MSAL doesn’t natively generate client assertion JWTs, but you can use System.IdentityModel.Tokens.Jwt:

    # Load your certificate
$cert = Get-PfxCertificate -FilePath "path-to-cert.pfx"

# Generate JWT client assertion manually
# Then use Invoke-RestMethod to call the token endpoint:
$body = @{
    client_id = "<your-client-id>"
    scope = "https://<tenant>.onmicrosoft.com/<api>/read"
    grant_type = "client_credentials"
    client_assertion_type = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
    client_assertion = "<your-JWT>"
}

$response = Invoke-RestMethod -Uri "https://<tenant>.b2clogin.com/<tenant>.onmicrosoft.com/<policy>/oauth2/v2.0/token" -Method POST -Body $body

     

Resources