Skip to content

Multiple Authentication Schemes

Jump to bottom
Jean-Marc Prieur edited this page Jun 14, 2023 · 13 revisions

Multiple authentication schemes

Microsoft Identity Web now supports multiple authentication schemes, as of v.1.11.0.

This means, as an app developer, you can have several authentication schemes in the same ASP.NET Core app. Such as signing-in users with two identity providers (two Azure AD web app registration), or an Azure AD app and an Azure AD B2C app, or a web app and a web API. Basically mixing authentication schemes in the same ASP.NET Core app.

Error IDW10503

If you get an error like he following when your controller calls Microsoft Graph, a downstream web API, or a token acquirer: IDW10503: Cannot determine the cloud Instance. The provided authentication scheme was ''. Microsoft.Identity.Web inferred 'Bearer' as the authentication scheme. Available authentication schemes are 'Cookies,OpenIdConnect,Bearer'. See https://aka.ms/id-web/authSchemes, you need to specify the authentication scheme to use to get the token (that is that maps to the right section of the appsettings.json)

Method How to specify the authentication scheme
IDownstreamWebApi.methods _downstreamWebApi.GetForUserAsync<Task>("apiMonitor", authenticationScheme:"AuthSchemeYouWantToUse");
IDownstreamWebApi.methods graphServiceClient.Me.GetRequest().WithAuthenticationScheme("AuthSchemeYouWantToUse").GetAsync();
ITokenAcquisition.GetAccessTokenForUserAsync tokenAcquisition.GetTokenForUserAsync(scopes, authenticationScheme:"AuthSchemeYouWantToUse" )
ITokenAcquisition.GetAccessTokenForAppAsync tokenAcquisition.GetTokenForAppAsync(scope, authenticationScheme:"AuthSchemeYouWantToUse" )

The rest of the article provides more details.

Example

See this developer test app, which shows how to have both an Azure AD B2C and Azure AD sign-in in the same app.

appsettings.json

In the appsettings.json you can now have two authentication schemes. In this example, we'll do one for Azure AD and one for Azure AD B2C. Both apps are registered in their respective portals.

{
    "AzureAdB2C": {
        "Instance": "https://fabrikamb2c.b2clogin.com",
        "ClientId": "fdb91ff5-5ce6-41f3-bdbd-8267c817015d",
        "Domain": "fabrikamb2c.onmicrosoft.com",
        "SignUpSignInPolicyId": "b2c_1_susi",
        "ResetPasswordPolicyId": "b2c_1_reset",
        "EditProfilePolicyId": "b2c_1_edit_profile", // Optional profile editing policy
        "CallbackPath": "/signin-oidc-b2c",
        "ClientSecret": "",
        "SignedOutCallbackPath": "/signout/B2C_1_susi"
    },
    "AzureAd": {
        "Instance": "https://login.microsoftonline.com/",
        "Domain": "msidentitysamplestesting.onmicrosoft.com",
        "TenantId": "7f58f645-c190-4ce5-9de4-e2b7acd2a6ab",
        "ClientId": "86699d80-dd21-476a-bcd1-7c1a3d471f75",
        "ClientSecret": "",
        "ClientCertificates": [
        ],
        "CallbackPath": "/signin-oidc"
    },
    "DownstreamApi": {
        "BaseUrl": "https://graph.microsoft.com/v1.0",
        "Scopes":