Azure-docs: Auth code flow vs implicit grant flow for mobile and desktop apps

[venkatfbi]

OAuth 2.0 spec defines confidential and public clients. https://tools.ietf.org/html/rfc6749#section-2.1

Here is the prescription according to the OAuth 2.0 spec

1. Confidential client - Web application - Auth code grant flow.
2. Public clients - Desktop App, Mobile App, SPA(Single page app) - Implicit flow.

However AD B2C's prescription according to Microsoft documentation is as follows
https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-reference-oauth-code

1. Confidential client - Web application - OpenIDConnect signin (Built on top of auth code grant)
2. Public clients - Desktop App, Mobile App - Auth code grant flow
3. Public clients - SPA(Single page app) - Implicit flow

Based on the above inference, we are clear with Web Apps and SPAs, no confusions here.

However for Desktop and mobile apps why is Microsoft suggesting Auth code grant flow even though they are public clients according to Microsoft documentation as well?

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: f3e20651-5b2b-bd0b-dc92-a4a3643776ef
• Version Independent ID: c9e25d10-4298-c95d-d24a-25a45c47e9ac
• Content: Authorization code flow in Azure Active Directory B2C
• Content Source: articles/active-directory-b2c/active-directory-b2c-reference-oauth-code.md
• Service: active-directory
• GitHub Login: @davidmu1
• Microsoft Alias: davidmu

[MohitGargMSFT]

@venkatfbi Thanks for your feedback! We will investigate and update as appropriate.

[MohitGargMSFT]

@venkatfbi Please refer to https://tools.ietf.org/html/rfc8252#section-8.2 which says below -

The OAuth 2.0 implicit grant authorization flow (defined in
Section 4.2 of OAuth 2.0 [RFC6749]) generally works with the practice
of performing the authorization request in the browser and receiving
the authorization response via URI-based inter-app communication.
However, as the implicit flow cannot be protected by PKCE [RFC7636]
(which is required in Section 8.1), the use of the Implicit Flow with
native apps is NOT RECOMMENDED.

Access tokens granted via the implicit flow also cannot be refreshed
without user interaction, making the authorization code grant flow --
which can issue refresh tokens -- the more practical option for
native app authorizations that require refreshing of access tokens.

I hope this helps answer your query.

[venkatfbi]

@MohitGargMSFT, Thanks for the reply.
In that case, can you please confirm whether Azure AD B2C authorize endpoint support the code_challenge_method, code_challenge, code_verifier, etc that are required for PKCE [RFC7636]? The above documentation does not talk about these. Would be helpful if these are updated if supported.

[MohitGargMSFT]

@venkatfbi Yes, they are supported. I will assign it to content author to update the document with these supported optional parameters.

[davidmu1]

Per engineering input, changed the paragraph to refer to refresh tokens:

The OAuth 2.0 authorization code flow is described in section 4.1 of the OAuth 2.0 specification. You can use it for authentication and authorization in most application types, including web applications and natively installed applications. You can use the OAuth 2.0 authorization code flow to securely acquire access tokens and refresh tokens for your applications, which can be used to access resources that are secured by an authorization server. The refresh token allows the client to acquire new access (and refresh) tokens once the access token expires, typically after one hour.

please-close

[femsulu]

@venkatfbi We will now close this issue. If there are further questions regarding this matter, please reopen it and we will gladly continue the discussion.

[jtourlamain]

When using PKCE I always get the reply "Clients must send a client_secret when redeeming a confidential grant". But isn't the point of using PKCE that some client apps can't keep a secret a secret? When registering an Azure B2C app as cebapp or natvie client, I always get the same error? What am I doing wrong?

[jeanpchr]

@jtourlamain I would like to ask the same question. Trying to integrate authorization code flow with PKCE to my angular app with a B2C authorization server. The server asks for the static client_secret even when I'm using PKCE, why is that?