Is OIDC Publish tier supported by Azure ADB2C? | Community
Skip to main content
T
thiagosilvagauge
Level 2
September 12, 2025
Question

Is OIDC Publish tier supported by Azure ADB2C?

  • September 12, 2025
  • 2 replies
  • 275 views

Hi everyone,

We are migrating our Azure AD B2C login systems, which are currently using SAML, to the OpenID Connect (OIDC) protocol. We came across this documentation: https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/security/open-id-connect-support-for-aem-as-a-cloud-service-on-publish-tier?utm_source=chatgpt.com
and we are using it for our implementation.

The problem is that we are getting the following error:

Caused by: com.nimbusds.oauth2.sdk.GeneralException: The returned issuer doesn't match the expected: https://apexbrasilb2cdev.b2clogin.com/[my_tenant_id]/

even though we are setting the baseUrl correctly, as shown in the document:

"baseUrl": "https://apexbrasilb2cdev.b2clogin.com/[my_tenant_id]/[my_custom_policy]"


And the well-known configuration is located at:

https://apexbrasilb2cdev.b2clogin.com/[my_tenant_id]/[my_custom_policy]/v2.0/.well-known/openid-configuration


Inside the .well-known file, the issuer is defined as:

"issuer": "https://apexbrasilb2cdev.b2clogin.com/[my_tenant_id]/v2.0/"


My first question is whether this documentation and the native OIDC support for the publish tier works with Azure AD B2C (since the document only mentions Entra ID / Azure AD).

Second, what could be causing this error? Everything appears to be configured correctly.

2 replies

kautuk_sahni
Community Manager
kautuk_sahniCommunity Manager
Community Manager
September 16, 2025

@santoshsai @pranay_m @sureshdhulipudi @briankasingli @hrishikeshkagne @shubham_borole @a_h_m_imrul @rahulpandey27, when you get a chance, could you review this question? Your input would be greatly appreciated!

 

Kautuk Sahni
shiftsaas
shiftsaas
Level 2
March 16, 2026

Yes, the native OIDC authentication handler in AEMaaCS works with external providers like Azure AD B2C, but the error you're seeing usually happens because the issuer returned in the OIDC metadata does not match the baseUrl expected by AEM.

In Azure AD B2C the issuer often looks like:

https://tenant.b2clogin.com/<tenant>/v2.0/

while the well-known configuration may be discovered using a policy path:

https://tenant.b2clogin.com/<tenant>/<policy>/v2.0/.well-known/openid-configuration

Because AEM validates the issuer strictly, this mismatch can trigger the error you posted.

AEM’s OIDC handler relies on the metadata discovery endpoint and expects the issuer to match the connection configuration exactly.

I documented the full AEM OIDC authentication flow and configuration (including metadata discovery and callback behavior) here: https://medium.com/@shiftsaas/implementing-id-me-openid-connect-oidc-with-aem-as-a-cloud-service-939c0b3e3553

AEM Developer | Technical Articles: https://medium.com/@shiftsaas
Terms & ConditionsAccessibility statement

Loading footer...