New B2C Endpoint is not working

[sebastianspross]

Library versions

• react-aad-msal: 2.3.3
• msal: 1.2.1

Describe the bug I am using the new URL for the AD B2C <name>.b2clogin.com and the library is calling https://login.microsoftonline.com/common/discovery/instance?api-version=1.0&authorization_endpoint=https://<name>.b2clogin.com/<name>.onmicrosoft.com/b2c_1_<name>/oauth2/v2.0/authorize (got this information from the browser console). In the end I am getting a 400.

Expected behavior For my understanding it should call https://<name>.b2clogin.com/kasiot.onmicrosoft.com/oauth2/v2.0/authorize?p=B2C_1_<name>&client_id=xxxxxx&nonce=defaultNonce&redirect_uri=http%3A%2F%2Flocalhost%3A3000&scope=openid&response_type=id_token&prompt=login.

To Reproduce Steps to reproduce the behavior: the authprovider.js

import { MsalAuthProvider, LoginType } from 'react-aad-msal';

// Msal Configurations
const config = {
  auth: {
    authority: 'https://<name>.b2clogin.com/<name>.onmicrosoft.com/B2C_1_<name>/',
    clientId: 'xxxxxx',
    redirectUri: 'http://localhost:3000'
  },
  cache: {
    cacheLocation: "localStorage",
    storeAuthStateInCookie: true
  }
};

// Authentication Parameters
const authenticationParameters = {
  scopes: [
    'https://<name>.onmicrosoft.com/api/user_impersonation'
  ]
}

// Options
const options = {
  loginType: LoginType.Redirect,
  tokenRefreshUri: window.location.origin + '/auth.html'
}

export const authProvider = new MsalAuthProvider(config, authenticationParameters, options)

Desktop (please complete the following information):

• chrome, edge

[sebastianspross]

Okay. I found something in the documentation here. By adding validateAuthority: false to auth everything is working as expected.

But what am I actually disabling there?

Maybe there should be a hint in your documentation. @andersthorsen