#ad authentication

Azure AD B2C is a Microsoft offering where a customer can use their current identity which can be with any of the listed provider’s Facebook, Google, Amazon, Twitter, etc to authenticate the business applications. B2C works on the ideology that there is no mandate for the customer to create his identity locally to access applications, customer can use their existing providers which they would be using for business or personal use to validate their identity.

With this model, the customer profile information such as Personal Identity Information PII, credential management stays with the customer trusted provider listed below. B2C service just leverages the provider to validate the customer to confirm “the customer is the one, he is claiming to be”.

Identity providers – Federation settings for:

Social identity providers like Facebook, LinkedIn, or Twitter that you want to support in your applications.

External identity providers that support standard identity protocols like OAuth 2.0, OpenID Connect, and more.

Local accounts enable users to sign up and sign in with a username (or email address or other ID) and password.

Below are quick steps on how you can set up and test B2C in Azure:

Login to Azure Portal, click Create a Resource –> Search Azure AD B2C

Next, you can create a B2C tenant or link and existing tenant

For this blog, I will create a new tenant “aldhanb2c” which  will also become sub-domain of onmicrosoft.com

Once the tenement is setup if you check Directory + subscription menu on Azure portal you can see the new tenant

Select the new tenant to navigate to Azure AD B2C instance

The primary configuration we need to setup is around Application

Create a new Application, in the configuration section, there is one important attribute which you need to set Reply Url. Reply Url is the callback URL where the B2C service will post user claims.

You can use https://jwt.ms as one of the entry, this will help in testing B2C service from Azure portal itself

Provide your application endpoint where the claims should be posted. This can be added later if you do not have details upfront

Generate an application key and save it this will be required while configuring a B2C application

Configuring the identity provider is core to enable Azure AD B2C service. There is a wide range of identity providers that can be enabled for your instance. List of identity providers are as below

Social identity providers like Facebook, LinkedIn, or Twitter that you want to support in your applications.

External identity providers that support standard identity protocols like OAuth 2.0, OpenID Connect, and more.

Local accounts enable users to sign up and sign in with a username (or email address or other ID) and password. To enable any of the listed identity providers some setup is also required to be done on the identity provider side such as Google, Facebook, etc Detailed steps for what is needed to be done for each identity provider is available @MSDocs For this blog, I have enabled Google and Local account

Azure AD B2C also provides the capability to capture custom attributes that may/may not be provider by the selected identity provider. Using the User Attribute option you can select attributes from a predefined list or can also create your own custom attribute

User flow is instrumental in orchestrating all the components we discussed in the above steps. User flow is the policy orchestration option where you can select what policies a user should experience when he/she tries to access application enabled with Azure AD B2C. In this blog I will discuss Sign up & signin policy, but you can also enable Profile edit, Password reset policy as well.

This slideshow requires JavaScript.

Once you select sign up and sign in policy, in the create screen you need to

provide a name

You can select one or more identity provider

You can select to enable Multifactor Authentication

You can select user attributes to be part of the claim

This slideshow requires JavaScript.

 Once you have created a policy you can further configure signin claims using the Application claim option. These claims will be returned by Azure AD B2C on successful signin

Under the customize segment you can select a Page layout from the options available. This layout will be presented to the user when the application navigates this user to the Azure AD B2C service.

The service is all set now an can be tested using the Run user flow option. As you can see when we click Run user flow, a wizard open in the right corner, also Settings are displayed and under the identity provider AladhanGoogleIdentity is listed.

In Step 7 earlier I explained to use https://jwt.ms, this reply URL will be used for testing.

Once Run is executed user is navigated to Azure AD B2C page layout. As you can see in items 15, for this policy I have google as well as the email identity provider. Hence on B2C page layout, I can see the same

 I will select Google login which navigates me to google oAuth page

Provide correct credentials, once validated by google auth server. Google replies to the claims to Azure AD B2C service which then propagates the claims to https://jwt.ms as we select that in item 16. In real work, Azure AD B2C will return claims to your application endpoint which can use the claims to process the user request