active-directory-b2c-dotnet-webapp-and-webapi | combined sample for a .NET web application | Azure library

We have two separeate dotnet core apis(API1 & API2) that are protected using azure ad b2c. Both these apis are registered on the b2c tenant and have their scopes exposed. We have a client web applicaiton that is to access the above protected apis. This web app has been registered as a applicaiton in b2c tenant and has api permissions set for the above apis with proper scopes defined.

We use MSAL.net with a signinpolicy to sign the user in to the web app. the authentication call requires scopes to mentioned. So we add API1's scope in the call. (note : one scope of a single resource can be added in a auth call shown below)

I've been following the tutorial here: https://github.com/Azure-Samples/active-directory-b2c-dotnet-webapp-and-webapi and have managed to get a web app authenticating with Azure B2C. I have also managed to get the web app to call ONE web API as instructed in the template.

My question is how do you call more than one API using this method? I may have 4-5 web API's set up as in the example and want to call all of them from a single web app. Is this possible? If so are there any examples I can take a look at?

Thanks.

I'm looking at the B2C API demos, and API documentation and I'm unable to determine the preferred method for managing authorization.

Azure AD supports assigning AD Users/Groups to apps, and also roles. Seemingly B2C doesn't support this. (I experimented by using AAD tasks against a B2C tenant. Hopefully I did it correctly)

Given that a singular B2C tenant will offer web sign in, and most likely API access as well, what is the benefit of creating more than one scope as exhibited in the TodoList:TodoListScope.

• Can I conditionally add additional scopes? Using B2C or store it in the graph/application somewhere?

https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/tree/master/4-WebApp-your-API/4-2-B2C

• Or more abstractly, how should I perform authorization to the many different APIs (and apps) when an id_token is exchanged for an access_token?

Perhaps API Management will give me ideas on how to perform RBAC or other permissioning. Added them as a tag as well

I've followed this post in relation to this example and made the additions to the portal and code as suggested:

Portal: Web API - Expose an API - Add Scope for "offline_access" (also tried with format "demo.offline_access"); Web App added "offline_access" permission

Code: Added offline_access to Start_Auth.cs, Global.cs and both Web.config files.

I make my request for accessToken and refreshToken as per documentation with:

I'm following this WebApp-WebAPI example. Is there a method to retrieve an id_token after a B2C user is authorized and the id_token is received within the body? I'm on Function app V3.

I receive the authorization response to replyURL in an azure Function app but the id_token coming in a body mixed with code and state data, and I can't seem to break it out or deserialize to json:

I've created a simple Blazor server application linking to an Azure B2C directory for authorization. Everything works but I need to add additional role claims to the token. Research has pointed me to this SO post which refers to adding the claims during the AuthorizationCodeReceived notification(Example here).

I understand what I need to do, but the example is using OpenIdConnectAuthentication (from Microsoft.Owin.Security.OpenIdConnect) instead of Blazor server's Microsoft.AspNetCore.Authentication.AzureADB2C.UI.

How can I still access and amend the claims in the token once it's received? Is such a thing supported in Microsoft.AspNetCore.Authentication.AzureADB2C.UI or should be switching to OpenId?

Below is the boilerplate included in a basic Blazor server application but the AzureADB2COptions are all just string config values.