azure-ad-b2cmulti-factor-authentication.net-4.6ropc

Is it possible to use ROPC to update profile if sign-in was done using Authorization Code with MFA?


We're in the process of migrating our authentication process from ROPC to Authorization Code with MFA. We currently use ROPC for Sign Up, Sign In, Reset Password, Forgot Password, and Profile Edit. Due to the MFA requirement, we need to move the Sign Up, Sign In, Reset Password, and Forgot Password flows over to the Authorization Code flow.

Does anyone know if it will be possible to continue using ROPC for the Profile Edit part? Or will it be blocked because of the MFA requirement?


Solution

  • I agree with @rbrayb, it will be blocked if your Profile Edit user flow has MFA enabled.

    enter image description here

    You need to use interactive flows like authorization code flow if MFA is enabled for either user flows or users.

    To get authorization code, make use of below authorization request:

    https://b2ctenant.b2clogin.com/b2ctenant.onmicrosoft.com/B2C_1_ProfileEdit/oauth2/v2.0/authorize?
    &client_id=appID
    &response_type=code
    &redirect_uri=https://jwt.ms
    &response_mode=query
    &scope=https://b2ctenant.onmicrosoft.com/xxxxxx/access_as_user
    &state=12345
    

    When I ran above request in browser, it asked for MFA like this:

    enter image description here

    After completing MFA, it asked to update User Details like below:

    enter image description here

    Later, it redirected me with authorization code value in address bar like this:

    enter image description here

    I generated access token using authorization code flow via Postman with below parameters:

    POST https://b2ctenant.b2clogin.com/b2ctenant.onmicrosoft.com/B2C_1_ProfileEdit/oauth2/v2.0/token
    grant_type:authorization_code
    client_id:appID
    client_secret:secret
    scope: https://b2ctenant.onmicrosoft.com/xxxx/access_as_user openid
    code:<code_from_above_Step>
    redirect_uri: https://jwt.ms
    

    Response:

    enter image description here

    When I decoded the token by pasting it in jwt.ms, it has claims like below:

    enter image description here

    In your case, you cannot use ROPC flow if Profile Edit user flow has MFA enabled. Instead, you have to use interactive flow like authorization code flow for Profile Edit part too.