Autenticación con Azure Active Directory B2C –End to End-

services.AddDistributedMemoryCache();

services.Configure<CookiePolicyOptions>(options =>
{
    // This lambda determines whether user consent for non-essential cookies is needed for a given request.
    options.CheckConsentNeeded = context => true;
    options.MinimumSameSitePolicy = SameSiteMode.Unspecified;
    // Handling SameSite cookie according to https://docs.microsoft.com/en-us/aspnet/core/security/samesite
    options.HandleSameSiteCookieCompatibility();
});

// Configuration to sign-in users with Azure AD B2C
services.AddMicrosoftIdentityWebAppAuthentication(Configuration, "AzureAd");

services.AddControllersWithViews(options =>
{
    var policy = new AuthorizationPolicyBuilder()
    .RequireAuthenticatedUser()
    .Build();
    options.Filters.Add(new AuthorizeFilter(policy));
}).AddMicrosoftIdentityUI();
services.AddRazorPages();

//Configuring appsettings section AzureAdB2C, into IOptions
            services.AddOptions();
            services.Configure<OpenIdConnectOptions>(Configuration.GetSection("AzureAd"));

app.UseCookiePolicy();

app.UseAuthentication();
app.UseAuthorization();

app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllerRoute(
                    name: "default",
                    pattern: "{controller=Home}/{action=Index}/{id?}");
                endpoints.MapRazorPages();
            });

[Authorize]
public class HomeController : Controller
{

private readonly ITokenAcquisition _tokenAcquisition;

private IConfiguration Configuration { get; }

public HomeController(ILogger<HomeController> logger, IConfiguration configuration, ITokenAcquisition tokenAcquisition)
{
    _logger = logger;
    _tokenAcquisition = tokenAcquisition;

    Configuration = configuration;
}

var user = HttpContext.User;
ViewData["User"] = user;

@{
    var user = ViewData["User"] as ClaimsPrincipal;
}

<table class="table table-striped table-bordered table-condensed table-hover">
    <tr>
        <th>ClaimType</th>
        <th>Value</th>
    </tr>

    @foreach (var claim in user.Claims)
    {
        <tr>
            @{
                if (claim.Type == "groups")
                {
                    <td><b>@claim.Type</b></td>
                }
                else
                {
                    <td>@claim.Type</td>
                }
            }
            <td>@claim.Value</td>
        </tr>
    }
</table>

@using Microsoft.Identity.Web
@if (User.Identity.IsAuthenticated)
{
<ul class="nav navbar-nav navbar-right">
    <li class="navbar-text">Hello @User.GetDisplayName()!</li>
    <li class="navbar-btn">
        <form method="get" asp-area="MicrosoftIdentity" asp-controller="Account" asp-action="EditProfile">
            <button type="submit" class="btn btn-primary" style="margin-right:5px">Edit Profile</button>
        </form>
    </li>
    <li><a asp-area="MicrosoftIdentity" asp-controller="Account" asp-action="SignOut">Sign out</a></li>
</ul> }
            else
            {
<ul class="nav navbar-nav navbar-right">
    <li><a asp-area="MicrosoftIdentity" asp-controller="Account" asp-action="SignIn">Sign in</a></li>
</ul>}

<partial name="_LoginPartial" />

"AzureAd": {
    "Instance": "https://{tenant}.b2clogin.com",
    "Domain": "{tenant}.onmicrosoft.com",
    "ClientId": "...0fe347",
    "TenantId": "...16dc876",
    "CallbackPath": "/signin-oidc",
    "SignedOutCallbackPath ": "/signout-callback-oidc",
    "SignUpSignInPolicyId": "B2C_1_...",
    "ResetPasswordPolicyId": "B2C_1_...",
    "EditProfilePolicyId": "B2C_1_...",
    // To call an API
    "ClientSecret": ""
  }

// Adds Microsoft Identity platform (AAD v2.0) support to protect this Api
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        .AddMicrosoftIdentityWebApi(options =>
        {
            Configuration.Bind("AzureAdB2C", options);

            options.TokenValidationParameters.NameClaimType = "name";
        },
options => { Configuration.Bind("AzureAdB2C", options); });

app.UseAuthentication();
app.UseAuthorization();

[Authorize]
[ApiController]
[Route("[controller]")]
public class WeatherForecastController : ControllerBase
{

// The Web API will only accept tokens 1) for users, and 2) having the "access_as_user" scope for this API
static readonly string[] scopeRequiredByApi = new string[] { "access_as_user" };

public IEnumerable<WeatherForecast> Get()
{
    HttpContext.VerifyUserHasAnyAcceptedScope(scopeRequiredByApi);

"AzureAdB2C": {
    "Instance": "https://{tenant}.b2clogin.com",
    "Domain": "{tenant}.onmicrosoft.com",
    "ClientId": "...eec754ca987f",
    "TenantId": "...a867e16dc876",
    "SignedOutCallbackPath ": "/signout/B2C_1_InicioSesion",
    "SignUpSignInPolicyId": "B2C_1_InicioSesion",
    "ResetPasswordPolicyId": "B2C_1_OlvidoContrasena",
    "EditProfilePolicyId": "B2C_1_EditarPerfil", // Optional profile editing policy
    //"CallbackPath": "/signin/B2C_1_sign_up_in"  // defaults to /signin-oidc
    "ClientSecret": ""
  }

"ClientSecret": "8xcP.KsnfG3l5HUXRU_r~.Bc~XXXXXXX"

"TestApi": {
    "Scope": "https://{tenan}.onmicrosoft.com/{id}/access_as_user",
    "TestApiBaseAddress": "http://localhost:49157"
  },

// Configuration to sign-in users with Azure AD B2C
services.AddMicrosoftIdentityWebAppAuthentication(Configuration, "AzureAd")
        .EnableTokenAcquisitionToCallDownstreamApi(new string[] { Configuration["TestApi:Scope"] })
        .AddInMemoryTokenCaches();

private async Task<HttpClient> PrepareAuthenticatedClient()
{
    try
    {
        var accessToken = await _tokenAcquisition.GetAccessTokenForUserAsync(new[] { Configuration["TestApi:Scope"] });
        Debug.WriteLine($"access token-{accessToken}");
        HttpClient _httpClient = new HttpClient();
        _httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
        _httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

        return _httpClient;
    }
    catch (Exception ex)
    {
        return new HttpClient();
    }
}

private async Task<string> GetTest(HttpClient httpClient)
{
    try
    {
        string testApiBaseAdress = Configuration["TestApi:TestApiBaseAddress"];
        var response = await httpClient.GetAsync($"{ testApiBaseAdress}/weatherforecast");

        if (response.StatusCode == HttpStatusCode.OK)
        {
            var content = await response.Content.ReadAsStringAsync();
            return content;
        }
        else
        {
            return response.StatusCode.ToString();
        }
    }
    catch (Exception ex)
    {
        return ex.Message;
    }
}

//CALL API
var httpClient = PrepareAuthenticatedClient().GetAwaiter().GetResult();
var resultApi = GetTest(httpClient).GetAwaiter().GetResult();
ViewData.Add("ResultApi", resultApi);

<table class="table table-striped table-bordered table-condensed table-hover">
    <tr>
        <td colspan="2">Test API</td>
        <td colspan="2"></td>
    </tr>

    <tr>
        <td colspan="2">Response</td>
        <td colspan="2">@ViewData["ResultApi"]</td>
    </tr>
</table>

private static async Task<Dictionary<string, string>> ProcessUserGroupsB2C(GraphServiceClient graphClient, string userId)
{
    Dictionary<string, string> groupClaims = new Dictionary<string, string>();
    try
    {
        // Before instatntiating GraphServiceClient, the app should have granted admin consent for 'GroupMember.Read.All' permission.
        //var graphClient = context.HttpContext.RequestServices.GetService<GraphServiceClient>();

        if (graphClient == null)
        {
            Console.WriteLine("No service for type 'Microsoft.Graph.GraphServiceClient' has been registered in the Startup.");
        }
        else
        {

            // The properties that we want to retrieve from MemberOf endpoint.
            string select = "id,displayName,onPremisesNetBiosName,onPremisesDomainName,onPremisesSamAccountNameonPremisesSecurityIdentifier";

            IUserMemberOfCollectionWithReferencesPage memberPage = new UserMemberOfCollectionWithReferencesPage();
            try
            {
                //Request to get groups and directory roles that the user is a direct member of.
                memberPage = await graphClient.Users[userId].MemberOf.Request().Select(select).GetAsync().ConfigureAwait(false);
            }
            catch (Exception graphEx)
            {
                var exMsg = graphEx.InnerException != null ? graphEx.InnerException.Message : graphEx.Message;
                Console.WriteLine("Call to Microsoft Graph failed: " + exMsg);
            }

            if (memberPage?.Count > 0)
            {
                // There is a limit to number of groups returned, below method make calls to Microsoft graph to get all the groups.
                var allgroups = ProcessIGraphServiceMemberOfCollectionPage(memberPage);

                if (allgroups?.Count > 0)
                {
                    // Re-populate the `groups` claim with the complete list of groups fetched from MS Graph
                    foreach (Group group in allgroups)
                    {
                        // The following code adds group ids to the 'groups' claim. But depending upon your reequirement and the format of the 'groups' claim selected in
                        // the app registration, you might want to add other attributes than id to the `groups` claim, examples being;

                        // For instance if the required format is 'NetBIOSDomain\sAMAccountName' then the code is as commented below:
                        // groupClaims.Add(group.OnPremisesNetBiosName+"\\"+group.OnPremisesSamAccountName));
                        groupClaims.Add(group.Id, group.DisplayName);
                    }
                }
            }
        }
    }
    catch (Exception ex)
    {
        Console.WriteLine(ex.Message);
    }

    return groupClaims;
}

private static async Task<Dictionary<string, string>> ProcessUserJobInfoB2C(GraphServiceClient graphClient, string userId)
{
    Dictionary<string, string> Jobinfo = new Dictionary<string, string>();
    try
    {

        if (graphClient == null)
        {
            Console.WriteLine("No service for type 'Microsoft.Graph.GraphServiceClient' has been registered in the Startup.");
        }
        else
        {
            Microsoft.Graph.User result = new User();
            try
            {
                result = await graphClient.Users[userId]
                        .Request().Select(e => new
                        {
                            e.DisplayName,
                            e.Id,
                            e.Identities,
                            e.JobTitle,
                            e.CompanyName,
                            e.Department
                        }).GetAsync();
            }
            catch (Exception graphEx)
            {
                var exMsg = graphEx.InnerException != null ? graphEx.InnerException.Message : graphEx.Message;
                Console.WriteLine("Call to Microsoft Graph failed: " + exMsg);
            }

            Jobinfo.Add("CompanyName", result.CompanyName);
            Jobinfo.Add("Department", result.Department);
            Jobinfo.Add("JobTitle", result.JobTitle);
        }
    }
    catch (Exception ex)
    {
        Console.WriteLine(ex.Message);
    }

    return Jobinfo;
}

public static async Task<Dictionary<string, string>> GetSignedInUsersGroupsB2C(GraphServiceClient graphClient, string userId)
{
    Dictionary<string, string> groupClaims = new Dictionary<string, string>();

    groupClaims = await ProcessUserGroupsB2C(graphClient, userId);

    var jobInfo = await ProcessUserJobInfoB2C(graphClient, userId);
    foreach (var item in jobInfo)
    {
        groupClaims.Add(item.Key, item.Value);
    }

    return groupClaims;
}

[HttpGet("GetGraph")]
public Dictionary<string,string> GetGraph()
{
    //HttpContext.VerifyUserHasAnyAcceptedScope(scopeRequiredByApi);

    var user = HttpContext.User;
    
    var configAz = Configuration.GetSection("AzureAdB2C");

    IConfidentialClientApplication confidentialClientApplication = ConfidentialClientApplicationBuilder
        .Create(configAz.GetSection("ClientId").Value)
        .WithTenantId(configAz.GetSection("TenantId").Value)
        .WithClientSecret(configAz.GetSection("ClientSecret").Value)
        .Build();
    ClientCredentialProvider authProvider = new ClientCredentialProvider(confidentialClientApplication);

    // Set up the Microsoft Graph service client with client credentials
    GraphServiceClient graphClient = new GraphServiceClient(authProvider);
    var userId = user.Claims.Where(x => x.Type == "http://schemas.microsoft.com/identity/claims/objectidentifier").Select(x => x).FirstOrDefault().Value;

    var grupos = GraphHelper.GetSignedInUsersGroupsB2C(graphClient, userId).GetAwaiter().GetResult();

    return grupos;
}

"ClientSecret": "EF.6.6A09_Bq3AgEaXXXXXXXX"

private async Task<Dictionary<string, string>> GetTestGraph(HttpClient httpClient)
{
    try
    {
        string testApiBaseAdress = Configuration["TestApi:TestApiBaseAddress"];
        var response = await httpClient.GetAsync($"{ testApiBaseAdress}/weatherforecast/GetGraph");
        if (response.StatusCode == HttpStatusCode.OK)
        {
            var content = await response.Content.ReadAsStringAsync();
            var result = JsonConvert.DeserializeObject<Dictionary<string, string>>(content);

            return result;
        }
        else
        {
            return new Dictionary<string, string>();
        }
    }
    catch (Exception ex)
    {
        return new Dictionary<string, string>();
    }
}

//CALL API GRAPH
var resultApiGraph = GetTestGraph(httpClient).GetAwaiter().GetResult();
ViewData.Add("ResultApiGraph", resultApiGraph);

@{
    Dictionary<string, string> resultApiGraph = new Dictionary<string, string>();

    if (ViewData.ContainsKey("ResultApiGraph"))
    {
        resultApiGraph = ViewData["ResultApiGraph"] as Dictionary<string, string>;
    }

}

<table class="table table-striped table-bordered table-condensed table-hover">
    <tr>
        <td colspan="2">API Graph test</td>
        <td colspan="2"></td>
    </tr>

    @if (resultApiGraph != null)
    {
        @foreach (var group in resultApiGraph)
        {
            <tr>
                <td colspan="2">@group.Key</td>
                <td colspan="2">@group.Value</td>
            </tr>
        }
    }
</table>