question

luizhlelis avatar image
1 Vote"
luizhlelis asked amanpreetsingh-msft commented

Sign in using resource owner password credentials (ROPC) returns "Not Found"

I created a User Flow on my Azure Active Directory B2C with the "Sign in using resource owner password credentials (ROPC)" type. I followed all the doc steps, but I'm receiving 404 status code as response with the following message:

The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.

I've already read some similar problems but no one of their solution had solved my problem:

Note: I'm not using any Custom Domain, I still using the default one "my-tenant.onmicrosoft.com"

That's the way how I'm trying to validate the ROPC User Flow:

 curl --request POST \
   --url 'https://my-tenant.b2clogin.com/my-tenant.onmicrosoft.com/oauth2/v2.0/token?p=b2c_1_ropc_auth' \
   --header 'Content-Type: application/x-www-form-urlencoded' \
   --header 'Host: login.microsoftonline.com' \
   --data client_id=<my-client-id-goes-here> \
   --data 'scope=openid <my-client-id-goes-here>' \
   --data grant_type=password \
   --data username=username@gmail.com \
   --data password=StrongPassword@123 \
   --data response_type=token

What am I doing wrong?



azure-ad-b2c
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

I tried also as the following:

 curl --request POST \
   --url https://my-tenant.b2clogin.com/my-tenant.onmicrosoft.com/b2c_1_ropc_auth/oauth2/v2.0/token \
   --header 'Content-Type: application/x-www-form-urlencoded' \
   --header 'Host: login.microsoftonline.com' \
   --data client_id=<my-client-id-goes-here> \
   --data 'scope=openid <my-client-id-goes-here>' \
   --data grant_type=password \
   --data username= username@gmail.com \
   --data password=StrongPassword@123 \
   --data 'response_type=token'

That's different from the endpoint specified in ".well-known" specification but that's the way how the official documentation recommends and also the way how msal-for-python is doing it. I still receiving 404 Not Found status code but now without any message.


1 Vote 1 ·

1 Answer

amanpreetsingh-msft avatar image
1 Vote"
amanpreetsingh-msft answered amanpreetsingh-msft commented

@luizhlelis • Can you try without the --header 'Host' parameter?

Also, username@gmail.com must be a local account. ROPC won't work with actual Gmail Username and Password as it doesn't provide the capability to redirect to google's auth endpoint.

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@amanpreetsingh-msft • It worked without the --header 'Host' parameter, that was the problem. About the username: I was testing it with a local account.
Thank you very much!

0 Votes 0 ·

@luizhlelis • Thanks for the update. Glad that it helped.

Converting my comment to answer. Kindly "Accept the answer" to help us and others in the community.

1 Vote 1 ·