Microsoft-authentication-library-for-js: 'user.read' scope

[00vareladavid]

Library

• [x] [email protected] or @azure/[email protected]
• [ ] @azure/[email protected]
• [ ] @azure/[email protected]
• [ ] @azure/[email protected]
• [ ] @azure/[email protected]

Description

Please provide your question here, including as much relevant details as possible.

I am new to both ad b2c and msal. I'm trying to follow this tutorial: https://github.com/Azure-Samples/active-directory-b2c-javascript-msal-singlepageapp. I seem to have auth configured correctly, but I get an error The scope 'User.Read' provided in the request is not supported. Can someone point me to what I may be doing incorrectly? Thanks for your time!

[00vareladavid]

Do I somehow have to create that scope through the azure portal?

[jasonnutter]

@00vareladavid You need to enable that scope for your application in the Portal (under the "API Permissions" blade).

[derisen]

Hi @00vareladavid,

the sample you mention is calling a web api that has only the scope .../demo.read, so that will have to be the scope requesting an access token. For instance,

    const tokenRequest = {
        scopes: ["https://fabrikamb2c.onmicrosoft.com/helloapi/demo.read"]
    };

When requesting an id token, the scopes you pass to loginRequest object are used. There, the scope openid is crucial to get the id token, whereas the other scopes are for what the user pre-consents (so that they can get an access token silently for these scopes). Since the sample is calling a custom web API, user.read is not defined for it (it's a scope for Microsoft Graph API), since, as I said, that web api has only the scope .../demo.read

For that sample, your loginRequest object should look like this:

    const loginRequest = {
        scopes: ["openid", "profile"]
    };

[00vareladavid]

Thank you for the quick replies.

Your advice helped me pinpoint my problem. I had this line:

const scopes = ["openid", "profile", "User.Read"]        

Changing it to the following solved my problem:

const scopes = ["openid", "profile"]