[Documentation] B2C support for redirect_uri

[karpikpl]

Documentation related to component

I've been looking for documentation on how to configure redirect_uri for B2C but it seems to be missing.
There's the "CallbackPath": "/signin-oidc" but no RedirectUri is used in public client?

microsoft-identity-web/src/Microsoft.Identity.Web.TokenAcquisition/AspNetCore/TokenAcquisitionAspnetCoreHost.cs

Line 127 in bf77c78

public string? GetCurrentRedirectUri(MergedOptions mergedOptions)

Please check all that apply

• typo
• [ x] documentation doesn't exist
• documentation needs clarification
• error(s) in the example
• needs an example

Description of the issue

When you run the B2C app behind a proxy (like app service behind azure front door) the redirect URL needs to be configured for the proxy, not for the web app.

Redirect can be changed in code, but for other MSAL libraries that can be set in configuration.

Is this the intended way of handling this?

        // Ensure correct redirect URI handling
        options.Events.OnRedirectToIdentityProvider = async context =>
        {
            await parentHandler(context);

            var request = context.Request;
            var forwardedHost = request.Headers["X-Forwarded-Host"].FirstOrDefault();
            var forwardedProto = request.Headers["X-Forwarded-Proto"].FirstOrDefault();

            var scheme = forwardedProto ?? request.Scheme;
            var host = forwardedHost ?? request.Host.Host;
            var port = request.Host.Port ?? -1;

            var uriBuilder = new UriBuilder(scheme, host, port)
            {
                Path = context.Options.CallbackPath.HasValue ? context.Options.CallbackPath.Value : "/signin-oidc",
            };

            var logger = context.HttpContext.RequestServices.GetRequiredService<ILogger<MyApp>>();

            logger.LogInformation("Redirecting to {redirectUri}", context.ProtocolMessage.RedirectUri);
            logger.LogInformation("AFD built URL would be: {redirectUri}", uriBuilder.Uri);

            context.ProtocolMessage.RedirectUri = uriBuilder.Uri.ToString();
        };
    });

[michiproep]

I'm a little confused by your description "like app service behind azure front door". Either I get it wrong but this does not look like a "public client".
Of course, your app has to "app.UseForwardedHeaders();" and configure them with "Services.Configure < ForwardedHeadersOptions > (options => ..."
and your reverse proxy need to set those headers correctly

[karpikpl]

Hi, public client refers to how OAuth flow is executed not networking.
In this case, the application is JavaScript React JS - it cannot hold secrets as it executes in the browser. making it "public client".

In other MSAL libraries, I can specify RedirectUri to be https://my-fancy-domain.com/signin-oidc but for B2C I cannot do that.

[michiproep]

I'm still confused. If it is a js/react application, why did you share C# code ("OnRedirectToIdentityProvider")?
This repo ( https://github.com/AzureAD/microsoft-identity-web ) is for applications which can hold secrets

This library is for specific usage with:
Web applications, which sign in users and, optionally, call web APIs
Protected web APIs, which optionally call protected downstream web APIs

[karpikpl]

ups, I think you're right - it's been a long time. let me review my sample. I confused two different apps.
I was wrong about the public app.

it's C# mvc B2C app - generated from the template.

it gets this config by default:

  "AzureAdB2C": {
    "Instance": "https://login.microsoftonline.com/tfp/",
    "ClientId": "11111111-1111-1111-11111111111111111",
    "Domain": "qualified.domain.name",
    "SignedOutCallbackPath": "/signout/B2C_1_susi",
    "SignUpSignInPolicyId": "b2c_1_susi",
    "ResetPasswordPolicyId": "b2c_1_reset",
    "EditProfilePolicyId": "b2c_1_edit_profile",
    "CallbackPath": "/signin-oidc"
  },

I was expecting a way to change the RedirectUri.
I'll try your solution with app.UseForwardedHeaders();

[michiproep]

One more hint:
We just use
builder.Services.Configure<ForwardedHeadersOptions>(options => options.ForwardedHeaders = ForwardedHeaders.XForwardedProto);
All other options (which actually doesn't make sense and I can't remember the reason) did not work,
e.g. "options.ForwardedHeaders = ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedFor"