I wanted to implement ReactJS application authentication with Azure AD with OpenID connect. Microsoft has provided MSAL2.0 library (MSAL React supports the authorization code flow) but is it based on OpenID connect protocol?
Thanks,
Mahesh
MSAL Standards compliant with OAuth v2.0 and OpenID Connect (OIDC).
When it comes to your scenario MSAL React uses the OAuth 2.0 Authorization Code Flow with PKCE (Proof Key for Code Exchange), providing additional security.
You can find more information here MSAL for React
Related
According to the following documentation, I understand that OAuth2 is an Authorization protocol:
https://learn.microsoft.com/en-us/azure/active-directory/develop/authentication-vs-authorization#authorization
Considering that OAuth 2.0 authorization code flow is an authorization protocol, why in many application types and scenarios (including the code example below), authorization code flow is used to authenticate a user (using its password) then provides an access token to the application.
https://github.com/Azure-Samples/active-directory-b2c-dotnet-desktop
The confusion I have is that most OAuth2 flows use a user's password to identify her/him then provide an access token to the application.
As another example, I learned that PowerApps portal uses OAuth2 PKCE to identify users through B2C. It seems that PowerApps uses OAuth2 PKCE to authenticate users, not authenticate them. I was expecting OpenID Connect should be used for such a scenario.
Is OAuth2 Authorization Code flow an authentication or authentication protocol or both of them?
Yes, OAuth2 is an authorization protocol.
It did not provide a consistent way to authenticate and the social providers e.g. Facebook, Twitter etc. then rolled their own authentication models to provide this service.
As a result, OpenID Connect was developed. This provides a standard way to authenticate and is built on top of OAuth2.
(There was an earlier standard called OpenID for authentication but that is not often used now).
As per this:
"OpenID Connect (OIDC) is an authentication protocol built on OAuth 2.0 that you can use to securely sign in a user to an application. When you use the Microsoft identity platform's implementation of OpenID Connect, you can add sign-in and API access to your apps.
OpenID Connect extends the OAuth 2.0 authorization protocol for use as an authentication protocol, so that you can do single sign-on using OAuth.
OpenID Connect introduces the concept of an ID token, which is a security token that allows the client to verify the identity of the user.
The ID token also gets basic profile information about the user. It also introduces the UserInfo endpoint, an API that returns information about the user".
PKCE is for "OAuth 2.0 public clients utilizing the Authorization Code Grant.
These are susceptible to authorization code interception attacks.
This specification describes the attack as well as a technique to mitigate against the threat through the use of Proof Key for Code Exchange (PKCE, pronounced "pixy")".
So after authenticating with OIDC, PKCE makes the Authorization Code Grant flow more secure.
We have an application for which we would like to enable users to login into our application with their own Identity Providers like Google, ADFS etc with SAML 2.0 as protocol.
In this context our application will be SP and Identity Providers will be Google, ADFS.
But currently we don't have SAML implementation at our application, so we would like to use some platform like OneLogin/Okta/Auth0 as middle proxy between our application and IdP so that SAML related handling can be done at OneLogin/Okta/Auth0 and we need to get callback to our application with user details after success login.
Is this possible with any SASS based SAML providers? and how to do it.
Thanks in advance
Yes - connect to Auth0 / Okta via OpenID Connect and then connect the IDP to other IDP via SAML.
So in this context, Auth0 / Okta is a SAML SP.
Have a look here.
How to configure SSO using OAuth and OpenID connect for AD2BC for Azure ADB2C?
When you protect multiple apps with AAD B2C, SSO is enabled by default. There is no configuration needed. You can adjust the configuration of the SSO as seen here: https://learn.microsoft.com/en-us/azure/active-directory-b2c/session-behavior
This is my scenario: Client Windows Forms app authenticates with Azure AD and uses the access token to access several web api services. Until now, I was using the endpoint 1 and using the Azure portal to register both apps. It seems like there's a new way now, but I'm a little lost here.
For starters, it seems like both apps (client and server) can be registered in the same app in the new apps portal (https://apps.dev.microsoft.com). I do see a place to add platforms and I have added entries for the native and web api. But where do I go from here? For instance, in the azure portal, I must configure the client app in order for it to call the web api services. How do I that here?
Is there a complete sample for this scenario like the one we have to ADAL (https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-code-samples#native-application-to-web-api)?
Thanks,
Regards,
Luis
Please firstly refer to this document to know what's different about the v2.0 endpoint .When you build applications that integrate with Azure Active Directory, you need to decide whether the v2.0 endpoint and authentication protocols meet your needs. Please see the limitations of azure ad v2.0, such as you can use the v2.0 endpoint to build a Web API that is secured with OAuth 2.0. However, that Web API can receive tokens only from an application that has the same Application ID .
The v2.0 endpoint does not support SAML or WS-Federation; it only supports Open ID Connect and OAuth 2.0 ,To better understand the scope of protocol functionality supported in the v2.0 endpoint, read through OpenID Connect and OAuth 2.0 protocol reference.
You could refer to document how to call a web API from a .NET web app with Azure AD V2.0 (using MSAL to acquire and use access tokens), and here is the code sample on Github . The document includes how to add basic sign-in to a web app or how to properly secure a web API in azure ad v2.0 .
Does Google supports SAML 2.0 Enhanced Client Proxy profile as an Identity Provider?
If so, what is the endpoint to be used to send messages?
No - they don't. For application authentication, Google's path is OAuth and OpenID Connect. See their Identity Developer page.