microsoft-authentication-library-for-dotnet: [Bug] In WPF client the social login stack in the redirecting state

Now it is working 😉

@foxyjess1 @xammob @TuroczyX @jondmcelroy The fix is out. I have confirmed that I am no longer hit the “redirecting…” page…can you please do so as well and let us know? Thank you.

Thanks @jennyf19 for driving this to resolution!

@jondmcelroy Thanks for the call-out on exactly what you’d like to see in the docs, that’s super helpful. I’ve added a work item to add an expanded explanation to the Use b2clogin.com doc. Will tag this issue in the PR once I get there.

Edit: And thanks to @TuroczyX for the steps and screenshots, love it!

@jondmcelroy Yes that is the document that I refereed. That is not describe well what you have to do. But as I see, you wrote the replay URL to a wrong place. Screenshots attached.

1. Go to the Azure B2C page
2. From navigation pane (left side) choose the Azure Active Directory (Yes, the terminology is confusing)
3. App Registration
4. Click on the View all applications button.
5. Choose you App. (Look on the Application ID)
6. Settings
7. Replay URLs
8. Add you URL which should looks like this:

https://{your-tenant-name}.b2clogin.com/{your-tenant-name}.onmicrosoft.com/oauth2/authresp

1. Save it. And it will work.

In the previous version was /te in the URL. REMOVE IT! 😃

Confirmed! This is working for me now in our production app! Means we don’t have to rush out the change to b2clogin - although we’ll make sure we move to it soon! Thanks for the comms here! It’s been a very stressful 48 hours!!!

@TuroczyX Thanks for the direction, I finally figured out like you showed that I needed to update the app registration for the AD application NOT the B2C Application. The documentation needs to be updated with pictures and better explanation.

@jennyf19 Thanks for being on top of this and all of the communication!

For anyone else thinking about making the switch to b2clogin, you will need to update all of your applications to use the b2clogin at the same due to needing to validate the issuer at the server. So even if you properly authentication with the b2clogin at the client level, your server also needs to be updated to get metadata from the b2clogin.

I am hoping that the rollback happens soon so that I do not have to hotfix on a friday afternoon!

Thanks for the info! I hope this is the case and MS can address the issue. We can move to b2clogin - but we’d rather do it in a co trolled fashion than a massive rush to paper over MS’s cracks!!!

Appreciate the updates.

@foxyjess1 @xammob @TuroczyX @jondmcelroy B2C should have a fix out by end of day today, will update here if that timelines changes.

also, passing in my own HttpClient helped me get around the “redirecting” page.

class HttpClientFactory : IMsalHttpClientFactory
    {
        private HttpClient _httpClient;

        public HttpClientFactory()
        {
            _httpClient = new HttpClient(new HttpClientHandler() { UseDefaultCredentials = true })
            {
                MaxResponseContentBufferSize = 1 * 1024 * 1024 // 1 MB
            };

            _httpClient.DefaultRequestHeaders.Accept.Clear();
            _httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
        }

        public HttpClient GetHttpClient()
        {
            return _httpClient;
        }
    }

IMsalHttpClientFactory httpClientFactory = new HttpClientFactory();
var app = PublicClientApplicationBuilder
                .Create(AzureB2CClientId)
                .WithB2CAuthority(AzureAdAuthoritySignUpSignIn)
                .WithHttpClientFactory(httpClientFactory)
                .WithLogging(MyLoggingMethod, LogLevel.Info,
                       enablePiiLogging: false,
                       enableDefaultPlatformLogging: true)
                .Build();

documentation on setting this up

Thanks @jennyf19 … MS support have told us not to use the reg hack saying it’s unsafe - so we still have no solution for our users and re-deploying our desktop application using b2clogin.com is at least 2 weeks work… we’re desperate for a resolution…

thanks for the additional information @foxyjess1 and @xammob will update here as we learn more.

@TuroczyX @jondmcelroy With the repro @jondmcelroy sent me today, was able to repro the issue. Looks like the js code in window.location.replace is not executing

Hopefully will have more info for you tomorrow.

@jennyf19 I sent your an email with reproducible code.

I believe the documentation he is referring to is here: https://docs.microsoft.com/en-us/azure/active-directory-b2c/b2clogin. The application page is confusing because there are both reply urls (for webapp) and redirect URIs. The redirect URIs dont let you post URIs with https and they also dont accept non https urls.

@jennyf19 Yes I have tried with both: .WithB2CAuthority() and .WithAuthority().

@jennyf19 I am able to hit that endpoint and view the configuration.

Here is the screenshot of the error i am when clicking the social link to our active directory:

Yes, just the master is not. That used the old “login.microsoftonline.com” which does not work now.

@jennyf19 Its easy to reproduce. Just create a dotnet framework console program. Nuget in Microsoft.Identity.Client 4.3.1. Fill out the variables (tenantid, clientid, policy and scopes) and run the following code:

var AzureB2CTenant = "<tenantId>";
var AzureAdBaseAuthority = "https://login.microsoftonline.com/tfp/{tenant}/{policy}/oauth2/v2.0/authorize";
var AzureB2CClientId = "<clientid>";
var AzureB2CPolicySignUpSignIn = "<policy>";
var AzureAdAuthoritySignUpSignIn = AzureAdBaseAuthority.Replace("{tenant}", AzureB2CTenant)
    .Replace("{policy}", AzureB2CPolicySignUpSignIn);
var AzureAdScopes = new List<string> { "<scopes>" };
var azureClientApplication = PublicClientApplicationBuilder.Create(AzureB2CClientId).WithAuthority(AzureAdAuthoritySignUpSignIn).Build();
var authenticationResult = await azureClientApplication
    .AcquireTokenInteractive(AzureAdScopes)
    .WithAuthority(AzureAdAuthoritySignUpSignIn)
    .WithPrompt(Prompt.SelectAccount)
    .ExecuteAsync();

Console.WriteLine(authenticationResult.Account.Username);

IF you try to use an OpenID/Social link it will hang.