AADB2C90012 error after upgrade from 3.0.0-beta.1 to 3.0.1

[rdogmartin]

Several weeks ago we successfully migrated an Angular 14 app to Angular 16, switching from MSAL 2.X to 3.0.0-beta.1 in the process. Today I tried moving from the beta to the 3.0.1 release. Now when an unauthenticated user navigates to the home page we get this error:

ServerError: invalid_request: AADB2C90012: The scope 'openid profile offline_access' provided in request is not supported.

Previously, that user would have been redirected to the Microsoft's login page hosted by Azure B2C.

Our OpenId endpoint is https://aegispremier.b2clogin.com/aegispremier.onmicrosoft.com/b2c_1a_signup_signin/v2.0/.well-known/openid-configuration

I can't figure out what change I need to do to make things work. We use AzureB2C for authentication and have custom policies instead of user flows.

package.config:

"@azure/msal-angular": "3.0.1",
"@azure/msal-browser": "3.0.1",

Our configuration has not changed from 3.0.0-beta.1 to 3.0.1:

  public static getMsalConfig(): IPublicClientApplication {
    const envSettings = AuthConfigService.getEnvironmentService().getEnvSettings();

    const isIE =
      window.navigator.userAgent.indexOf('MSIE ') > -1 || window.navigator.userAgent.indexOf('Trident/') > -1;

    const msalConfig: Configuration = {
      auth: {
        clientId: envSettings.auth.clientId, // This is the ONLY mandatory field that you need to supply.
        authority: `https://${envSettings.auth.authorityDomain}/${envSettings.auth.domainName}/${envSettings.auth.signInPolicy}`, // e.g. 'https://aegispremierdev.b2clogin.com/aegispremierdev.onmicrosoft.com/B2C_1_aegis_signin'
        knownAuthorities: [envSettings.auth.authorityDomain],
        redirectUri: '/msal', // This URL must be registered in the SPA redirect URI section of the Azure B2C app registration (in each env).
        postLogoutRedirectUri: '/', // Indicates the page to navigate after logout.
        navigateToLoginRequestUrl: true, // If "true", will navigate back to the original request location before processing the auth code response.
      },
      cache: {
        cacheLocation: BrowserCacheLocation.LocalStorage, // Configures cache location. "sessionStorage" is more secure, but "localStorage" gives you SSO between tabs.
        storeAuthStateInCookie: isIE, // Set this to "true" if you are having issues on IE11 or Edge
      },
      system: {
        allowNativeBroker: true,
        loggerOptions: {
          loggerCallback(logLevel: LogLevel, message: string) {
            if (logLevel === LogLevel.Error) {
              AuthConfigService.getRaygunService().logError(message);
            }
          },
          logLevel: LogLevel.Warning,
          piiLoggingEnabled: false,
        },
      },
    };

    return new PublicClientApplication(msalConfig);
  }

  public static getMsalGuardConfig(): MsalGuardConfiguration {
    return {
      interactionType: InteractionType.Redirect,
      authRequest: {
        scopes: [],
      },
    };
  }

  public static getMsalInterceptorConfig(): MsalInterceptorConfiguration {
    const envSettings = AuthConfigService.getEnvironmentService().getEnvSettings();
    const protectedResourceMap = new Map<string, Array<string>>();
    const fecWriteScopes = [`https://${envSettings.auth.domainName}/api/fec.write`];

    protectedResourceMap.set(`${envSettings.fecApiEndpoint}/api/client`, fecWriteScopes);

    return {
      interactionType: InteractionType.Redirect,
      protectedResourceMap,
    };
  }

The above functions are called from the providers section of app.module.ts:

    {
      provide: MSAL_INSTANCE,
      useFactory: AuthConfigService.getMsalConfig,
    },
    {
      provide: MSAL_GUARD_CONFIG,
      useFactory: AuthConfigService.getMsalGuardConfig,
    },
    {
      provide: MSAL_INTERCEPTOR_CONFIG,
      useFactory: AuthConfigService.getMsalInterceptorConfig,
    },

[jingfee]

#6340

[rdogmartin]

Confirmed that this is fixed in 3.0.2.