Issue with Azure AD B2C Custom Policy: "Basic credentials specified for 'REST-fetchUserProfile-APAC' are invalid

Hi @Ray Garg ,

Thanks for the additional details and for clarifying your setup with the REST-login-NonInteractive-APAC and REST-fetchUserProfile-APAC technical profiles. I understand you're using the bearer token output from REST-login-NonInteractive-APAC to authenticate the REST-fetchUserProfile-APAC profile, which fetches user profile details via the Microsoft Graph API. Your question about integrating an API connector and whether to change the AuthenticationType to Basic is a great point to address. Let’s resolve this step-by-step.

Solution

1. Using an API Connector in REST-fetchUserProfile-APAC
   • Currently, your REST-fetchUserProfile-APAC profile is set up to use a bearer token (graph_bearerToken) to call the Microsoft Graph API (https://graph.microsoft.com/beta/me). This doesn’t require an API connector unless you intend to replace the Graph API call with a custom REST API endpoint.
   • If you want to continue using the Graph API, no API connector is needed—your existing bearer token configuration with UseClaimAsBearerToken is sufficient.
   • If you meant to use an API connector to call a custom REST service (e.g., to fetch additional user data), you can modify the REST-fetchUserProfile-APAC profile as follows:

<TechnicalProfile Id="REST-fetchUserProfile-APAC">
  <DisplayName>Fetch user profile cross tenant</DisplayName>
  <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
  <Metadata>
    <Item Key="ServiceUrl">https://your-custom-api-endpoint.com/userprofile</Item> <!-- Replace with your API URL -->
    <Item Key="AuthenticationType">Bearer</Item>
    <Item Key="UseClaimAsBearerToken">graph_bearerToken</Item>
    <Item Key="SendClaimsIn">Body</Item> <!-- Adjust based on your API's requirements -->
    <Item Key="DebugMode">true</Item>
  </Metadata>
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="graph_bearerToken" />
    <!-- Add other input claims if your API requires them, e.g., user ID -->
  </InputClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="id" />
    <OutputClaim ClaimTypeReferenceId="userPrincipalName" PartnerClaimType="upn" />
    <!-- Add other output claims based on your API response -->
  </OutputClaims>
  <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
</TechnicalProfile>

• Replace https://your-custom-api-endpoint.com/userprofile with the URL of your custom REST API.
• Ensure your API is configured to accept a bearer token in the Authorization header and returns the expected claims.

2. Do You Need to Change AuthenticationType to Basic?
   • No, you should not change the AuthenticationType to Basic. The error "Basic credentials specified for 'REST-fetchUserProfile-APAC' are invalid" suggests the policy might have been misconfigured to use Basic authentication (e.g., username/password) at some point. Since REST-login-NonInteractive-APAC provides a bearer token via the ROPC flow, and you’ve confirmed the app registration is set up correctly in the APAC tenant, keep AuthenticationType="Bearer" and UseClaimAsBearerToken="graph_bearerToken".
   • Switching to Basic would require adding a client ID and secret in the metadata, which isn’t applicable here given your token-based approach.
3. Verification of Current Setup
   • You mentioned the app registration in your APAC tenant has the necessary permissions and public client flows enabled. Ensure the REST-login-NonInteractive-APAC profile requests the correct scope (e.g., https://graph.microsoft.com/.default) to include the required Graph API permissions.
   • Check the bearer token’s scp and aud claims (using a tool like jwt.io) to confirm they include the expected permissions (e.g., User.Read.All) and audience (e.g., https://graph.microsoft.com).
   • If the call fails, test the stable Graph API endpoint (https://graph.microsoft.com/v1.0/me) instead of the beta endpoint to rule out API-specific issues.
4. Final Configuration
   • If you’re sticking with the Graph API (no custom API connector), your REST-fetchUserProfile-APAC profile should remain as is, with verification of the token:

<TechnicalProfile Id="REST-fetchUserProfile-APAC">
  <DisplayName>Fetch user profile cross tenant</DisplayName>
  <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
  <Metadata>
    <Item Key="ServiceUrl">https://graph.microsoft.com/beta/me</Item>
    <Item Key="AuthenticationType">Bearer</Item>
    <Item Key="UseClaimAsBearerToken">graph_bearerToken</Item>
    <Item Key="SendClaimsIn">Url</Item>
    <Item Key="DebugMode">true</Item>
  </Metadata>
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="graph_bearerToken" />
  </InputClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="id" />
    <OutputClaim ClaimTypeReferenceId="userPrincipalName" PartnerClaimType="upn" />
  </OutputClaims>
  <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
</TechnicalProfile>

Hope this helps! If you agree with my suggestion, feel free to interact with the system accordingly!