Calling a Function from a Web App

[stuartpy]

Hi,

I'm new to Microsoft.Identity.Web (and to ADB2C in general I'm afraid) and am struggling...

I want to call a Function from a Website. I have used the webapp2 and func2 templates to set everything up, but am confused by scopes and what to provide in the config.

I've done both my app registrations in Azure portal.

I've done "expose an API" within the Function app, and assigned permissions in the web app, and at the top of the Function App page the URL looks like:

https://<domain>.onmicrosoft.com/8839d78d-5788-46a7-9f89-a622bb314462

My scope is called "products.get".

I don't understand what I need to set for BaseURL and Scopes in appsettings.config. Currently I have this:

"BaseUrl": " http://localhost:7071/api/SampleFunc",
    "Scopes": "api://8839d78d-5788-46a7-9f89-a622bb314462/products.get"

When I run the webapp and function I get an error: The scope 'api://8839d78d-5788-46a7-9f89-a622bb314462/products.get' provided in the request is not supported.

If I change the Scopes section to https://.onmicrosoft.com/8839d78d-5788-46a7-9f89-a622bb314462/products.get I can sign in but then it bounces between waiting for localhost and waiting for b2clogin.com and will not progress.

Hoping someone can point me in the right direction for what I've done wrong.

Thanks

Stuart

[jmprieur]

@stuartpy

• In the app registration for the web api that is implemented by your Azure function, in the Expose an API tab, you can copy the scope (there is a copy icon). This should be the scopes you'll use in the config file. If you have a validated domain, your scope will be indeed "/products.get" instead of "api://guid_of_web_api/products.get"
• then, in the launchsettings.json for your azure function, you have the ports where your azure function can be called. you should have an url like https://localhost:xxx. where xxx is the SSL port for the profile. you'd want to use this URL + "api/SampleFunc" for the BaseURL. I believe that you want to replace "SampleFunc" by the name of the directory where you created your azure function with the template.

[stuartpy]

Thanks for the quick reply!

I've copied the scope so in appsettings for the website I now have this:

"BaseUrl": " http://localhost:7071/api/SampleFunc",
    "Scopes": "https://tillwitedirect.onmicrosoft.com/8839d78d-5788-46a7-9f89-a622bb314462/products.get"

My Function is running locally at http://localhost:7071/api/SampleFunc (I don't have launchsettings.json in the Function app but the console is saying this is what it is)

I believe that you want to replace "SampleFunc" by the name of the directory where you created your azure function with the template

I don't understand this, sorry. Is my Base URL not the URL the actual function is running on i.e. http://localhost:7071/api/SampleFunc

If I give my scope as just "products.get" then I get the error: The scope 'products.get' provided in the request is not supported.

If I give the full scope as above, I get the login screen, but after login I am "bounced" between localhost and b2clogin.com and the Immediate window fills with errors:

Microsoft.Hosting.Lifetime: Information: Hosting environment: Development
Microsoft.Hosting.Lifetime: Information: Content root path: <folder>
Microsoft.Identity.Web.TokenAcquisition: Error: (False) MSAL 4.30.0.0 MSAL.NetCore Microsoft Windows 10.0.19042 [05/06/2021 18:26:47 - ] Exception type: Microsoft.Identity.Client.MsalUiRequiredException
, ErrorCode: user_null
HTTP StatusCode 0
CorrelationId 

   at Microsoft.Identity.Client.Internal.Requests.Silent.SilentRequest.ExecuteAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.Silent.SilentRequest.ExecuteAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
Exception thrown: 'Microsoft.Identity.Web.MicrosoftIdentityWebChallengeUserException' in System.Private.CoreLib.dll
System.Net.Http.HttpClient.Default.LogicalHandler: Information: Start processing HTTP request POST https://tillwitedirect.b2clogin.com/tfp/tillwitedirect.onmicrosoft.com/b2c_1_signupin/oauth2/v2.0/token
System.Net.Http.HttpClient.Default.ClientHandler: Information: Sending HTTP request POST https://tillwitedirect.b2clogin.com/tfp/tillwitedirect.onmicrosoft.com/b2c_1_signupin/oauth2/v2.0/token
System.Net.Http.HttpClient.Default.ClientHandler: Information: Received HTTP response after 650.8337ms - OK
System.Net.Http.HttpClient.Default.LogicalHandler: Information: End processing HTTP request after 670.9397ms - OK
Microsoft.Identity.Web.TokenAcquisition: Error: (False) MSAL 4.30.0.0 MSAL.NetCore Microsoft Windows 10.0.19042 [05/06/2021 18:27:06 - ] Exception type: Microsoft.Identity.Client.MsalUiRequiredException
, ErrorCode: user_null
HTTP StatusCode 0
CorrelationId 

This is repeated over and over.

I'm not sure how to deal with "MsalUiRequiredException"

[jennyf19]

@stuartpy We have a sample app which calls a protected Azure function, maybe that will help you?
Here's the set up in the client in startup.cs. and in appsettings.json

and then in the Azure Function:
Startup.cs
and appsettings.json and SampleFunc.cs

Let us know if this helps.

[stuartpy]

@jennyf19 Unfortunately I'm no nearer, despite having spent 90 minutes checking code to the samples.

I did find some differences but they either don't help or don't work. For example I came across this page https://github.com/AzureAD/microsoft-identity-web/wiki/Azure-Functions which says I need to setup ConfigureServices with:

services.AddAuthentication(sharedOptions =>
            {
                sharedOptions.DefaultScheme = Microsoft.Identity.Web.Constants.Bearer;
                sharedOptions.DefaultChallengeScheme = Microsoft.Identity.Web.Constants.Bearer;
            })
           .AddMicrosoftWebApi(Configuration, "AzureAdB2C");

But when I do that I get a CS1061 error: Authentication Builder does not contain a definition for AddMicrosoftWebApi etc

If I use the .AddMicrosoftIdentityWebApi as provided by the template, the error goes away but I still cannot call the function.

We have a sample app which calls a protected Azure function

I struggled to find this in isolation. Is there a direct link to it please? I did find https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/tree/master/4-WebApp-your-API/4-2-B2C but this is for WebApi not Functions.

I still think the problem is configuration related and to do with "scopes". I'll try again from scratch at the weekend, with the two templates, and document everything. Perhaps that will show up something I've missed up until now.

[jennyf19]

@maliksahil do you have any suggestions here?