Hi @saravana,

Apologies for the delay in getting back here. We can see that your query on the Single Sign-on feature has been addressed by our support team via a ticket. Please feel free to write to support@freshdesk.com for any further queries in the future and we would be happy to help! :) 

Could you please let us know if you have any issues with configuring Single sign-on for your Freshdesk account @geebranz?

Cheers,

Freshdesk Community Team 

@saravana @hemanth.ramya 

I am facing the exact same error integrating Freshworks SSO with Azure B2C.

What is the fix here?

Add the Application Client id (Application registered in the B2C AD tenant) in the Scope field in Freshdesk OAuth configuration.

Thanks @saravana

The fix worked. This seriously needs to be documented somewhere.

Thanks for sharing your insights, @saravana. 

Glad to know that the issue is fixed. @sahilshah50. Sure, we have noted your feedback at our end. Feel free to drop a note here or write to support@freshdesk.com for any further queriesand we would be happy to help!

Cheers,

Freshdesk Community Team  

The postman screenshot mentioned is showing the IDToken and your freshworks application expect access token. Could you please validate the user flow with access token settings and also use the postman tool to get the access token. Please follow the below document for more requests.

https://docs.microsoft.com/en-us/azure/active-directory-b2c/openid-connect/Website

Please share fiddler trace to investigate more

I am having similar issues, Freshworks support are sending me round in circles…
 

I understood the fix to be add the App ID (GUID ?!) to the scopes field as an extra scope to request?

Any help appreciated.

I get this error after successful login:

Invalid token or user info response: could not extract identity from token

After much investigation I found out the following, I could not get OIDC to work but got OAuth2 to work.

Azure B2C does not have a user info endpoint.

The Freshdesk app expects a user info endpoint and to get the following values as a minimum:

• sub
• email

Returned as a JSON string.

I used the starter pack here:

https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/tree/main/SocialAndLocalAccounts

Then followed this guide to add the userinfo endpoint to it:

https://learn.microsoft.com/en-us/azure/active-directory-b2c/userinfo-endpoint?pivots=b2c-custom-policy

However, you need to adjust the returned values as the example uses a param that Freshdesk does not expect, the example returns ‘signInNames.emailAddress’ instead of ‘email’.

In the policy you need to adjust the input to change the output (really confused me that part).

The example claims provided are shown as this;

        <InputClaims>
          <InputClaim ClaimTypeReferenceId="objectId"/>
          <InputClaim ClaimTypeReferenceId="givenName"/>
          <InputClaim ClaimTypeReferenceId="surname"/>
          <InputClaim ClaimTypeReferenceId="displayName"/>
          <InputClaim ClaimTypeReferenceId="signInNames.emailAddress"/>
        </InputClaims>

Ensure you change them to this:

        <InputClaims>
          <InputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub" />
          <InputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
          <InputClaim ClaimTypeReferenceId="surname" PartnerClaimType="family_name" />
          <InputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
          <InputClaim ClaimTypeReferenceId="signInNames.emailAddress" PartnerClaimType="email" />
        </InputClaims>

This then returns the following response from the newly created userinfo endpoint:

{
    "sub": "12a2d167-53f1-416d-93df-cdf813392bf3",
    "given_name": "First",
    "family_name": "Last",
    "name": "First Last",
    "email": "first.last@example.com"
}

The application now can take that information and create the contact in Freshdesk and then let them login.

For completeness the following Freshdesk OAuth settings were used, ensure you provide the GUID of the application ID from the B2C tenant in the scope.

You can get the auth, token and user info endpoint URLs for your custom policy from the URL of.

https://YOURTENANT.b2clogin.com/YOURTENANT.onmicrosoft.com/v2.0/.well-known/openid-configuration?p=B2C_1A_SIGNUP_SIGNIN

It seems like the issue you're encountering might be related to the configuration of the access token endpoint URL in the SSO with OIDC settings. Here are a few steps you can take to troubleshoot:

1. Double-check that the access token endpoint URL obtained from the AD B2C signup sign-in user flow OIDC configuration matches the one configured in the SSO with OIDC settings in Freshworks.

2. Ensure that the scopes configured in Freshworks match the ones defined in the AD B2C signup sign-in user flow OIDC configuration (openid, email, profile).

3. Verify that the Client ID and Client Secret configured in Freshworks match the ones obtained from the application registered in the AD B2C tenant.

4. Test the access token endpoint URL using tools like Postman to ensure it returns a valid access token when provided with the authorization code received from the initial request.

5. Check for any errors or logs in the Freshworks configuration that might provide more insight into the issue.

By following these steps, you should be able to identify and resolve the issue with the access token endpoint URL configuration in Freshworks for SSO with OIDC integration with Azure AD B2C.