404 未找到 Azure AD B2C 的 oauth2/v2.0/token 端点

Question

I'm having a hard time receiving an access_token and refresh_token via the OAuth 2.0 API of Azure AD B2C.

I'm following the official guide describing the OAuth 2.0 authorization code flow.

Receiving an authorization_token via the interactive login website provided by Microsoft works fine (URL: https://login.microsoftonline.com/[MY_TENANT]/oauth2/v2.0/authorize?client_id=[CLIENT_ID]&response_type=code&response_mode=query&redirect_uri=urn%3Aietf%3Awg%3Aoauth%3A2.0%3Aoob&scope=[CLIENT_ID]%20offline_access&p=[MY_SIGNUP_SIGNIN_POLICY] ).

However, when trying to get an access_token via a simple POST request as stated in the documentation, I'm getting a 404 Not Found with the following POST request:

URL: https://login.microsoftonline.com/[MY_TENANT]/oauth2/v2.0/token?p=B2C_1_sign_in
Header: Content-Type application/x-www-form-urlencoded
Payload: grant_type=authorization_code&client_id=[CLIENT_ID]&scope=[CLIENT_ID]%20offline_access&code=[AUTHORIZATION_CODE]&redirect_uri=urn:ietf:wg:oauth:2.0:oob

Is the documentation wrong at that point?

Note: I'm not able to use any existing .NET or Java libraries providing this login procedure due to framework reasons. A C++ library would do.

I so very much want them to implement the usual complete headless OAuth2 protocol in a standard-conformant way ...

Answer 1

The problem was my misunderstanding of the documentation.

The policy (query parameter p ) must be the same in all cases. Thus, the URL for the POST request has to be:

https://login.microsoftonline.com/[MY_TENANT]/oauth2/v2.0/token?p=MY_SIGNUP_SIGNIN_POLICY

Where MY_SIGNUP_SIGNIN_POLICY is exactly the same as in the login URL.