Azure B2C oidc authentication with SPSE failed

[Ian_Morrish]

My AuthorizationEndpoint is defined in SP as

 "https://tenantName.b2clogin.com/tenantName.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1a_signup_sig..."

But when SP redirects, it drops the p=b2c_1a_signup_signin" and just has ?client_id=xxx...

Resulting in 404

I'm using custom Exp Framework in B2C so I can specify known x5c certificate for which the .cer is added to SP

Has anyone else got this to work?

[#2]

Think I found my problem, should be using OpenID connect format, not OAuth2. Very subtle difference where the flow name goes.
GET https://{tenant}.b2clogin.com/{tenant}.onmicrosoft.com/{policy}/oauth2/v2.0/authorize?

[#3]

Thank you Ian for trying on OIDC in SPSE. Good to know that you sorted out the problem.
Please let us know if you have further problem or suggestion regarding SharePoint Server authentication.

[#4]

Hmmm, still didn't work because SharePoint adds ?Source=/ to the redirect_uri which B2C apps don’t allow (Azure AD does allow and sample guide for configuring OIDC in Azure AD shows modifying the manafest to allow /* which is blocked in B2C).
URL Rewrite to the rescue. Handling the Password Rest flow from B2C is a little more tricky.

[#5]

@Ian_Morrish Is there any more detail about the error you are facing? 

The detail of your configurations and also the ULS Log?

Steve

[#6]

See Case #:30122271
IT is not an error, just incompatibility.
SharePoint will always append the ?source= to the OIDC redirect_uri value.
This also happens on session timeout and then SharePoint adds the relative path for the page the user is requesting to the source value.

B2C doesn't allow any parameter in the uri_redirect. It supports state or custom parameters for this. https://docs.microsoft.com/en-us/azure/active-directory-b2c/openid-connect

SharePoint team could resolve this as I don't think B2C team will allow URL parameters.
SP would need to have to option to do either:
append the source value just as a bookmark ( #relativpathForSPpage ) or implement a Source custom parameter.

[#7]

Hi Ian,

I got you. We haven't validated with Azure B2C OIDC. We will take a look.

Steve

[#8]

Hi Steve, any progress on this?

[#9]

Could you please try again? I remember we fixed it if my memory is fresh.