When I log into Azure AD B2C I don't get the preferred_username claim included id_token. Is there a way to configure this from the Azure portal? Pretty sure I would get this claim in regular Azure AD OIDC implicit flow.
I've tried looking at custom claims but it seems like this should be a built-in claim that gets included or mapped to some attribute.
This is a known issue with B2C and the MSAL libraries.
From the MSAL .NET wiki: B2C does not return a value in the IdToken for the preferred_username because of limitations with the social accounts and external identity providers (IdPs). Azure AD returns a value for preferred_username because it knows who the user is, but for B2C, because the user can sign in with a local account, Facebook, Google, GitHub, etc...there is not a consistent value for B2C to use for preferred_username. To unblock MSAL from rolling out cache compatibility with ADAL, we decided to use "Missing from the token response" on our end when dealing with the B2C accounts when the IdToken returns nothing for preferred_username. MSAL must return a value for preferred_username to maintain cache compatibility across libraries.
If you want to display a value in the UI, you should be able to use the login hint to pass in a username to pre-fill the sign-in UI. As noted in this MSAL .NET issue.
This is a known issue with Azure AD B2C.
This is because Azure AD B2C does not return a value in the IdToken
for the preferred_username because of limitations with the social
accounts and external identity providers (IdPs).Azure AD returns a
value for preferred_username because it knows who the user is, but for
Azure AD B2C, because the user can sign in with a local account,
Facebook, Google, GitHub, etc. there is not a consistent value for
Azure AD B2C to use for preferred_username.
Here is the Workarounds.
Related
Azure B2B gives simple steps for direct federation with google and facebook.Though, i don't see any documentation to establish direct federation with Auth0 or Okta. I tried myself with Auth0 at the time or invitation my user succesfully login with auth0 account but after redirection to invitation.microsoft.com getting redemtion failure.
Can someone give me steps to setup Auth0 as IDP and then configure that with Azure AD direct federation.
https://auth0.com/docs/protocols/saml-configuration-options/configure-auth0-as-saml-identity-provider
i have already setup everything as mentioned in above document but still not able to redeem invitation after login.
Any help would be highly appreciated!!!
Azure AD B2B can be configured to federate with identity providers that use the WS-Fed or SAML. There is no specific Document for direct federation either from OKTA or Azure. From Azure end Direct federation is only allowed for policies where the authentication URL’s domain matches the target domain, or where the authentication URL is one of these allowed identity providers as per this document. I recommend you to open a support case with Auth0 since it involves multiple parties.
I'm in a pickle, lacking the experiences that would provide me with guidance in my project and am seeking pointers from those for whom have Azure AD, SSO and Federation experience.
I am building an employee self service system and using Azure AD for identity management. I would like the user to be able to sign in using their employee ID # and password, not their email address; there should also be an option for the user to register for online access using their employee ID # and other personal information - their Azure Identity already having been established by humane resources.
The sign in flow would take the user to the Microsoft login page which would in turn detect that the user needs to sign in via a custom login page and redirect them there. Once they are signed in, my server would transmit their identity to Azure AD and grant them access based on the Azure Application permissions.
I'm simply really confused about how to start setting this up, if it's even possible. I'm aware of XSS but isn't Federation and SSO with SAML2 secure?
Do I need to use a federation application as a middle-man such as Ping Identity?
Thanks for any help!
Using e.g. Ping as an IDP generally won't help because Azure AD is already an IDP.
Microsoft Azure AD login pages can't be accessed by API and can't be customised to the extent you want.
And you can only sign-in with an email address because it's designed for domain-joined corporate customers.
You can do a lot of what you require with Azure AD B2C and custom policies. That will allow you to sign-in with a user name (= employee id) and you can create workflows.
You could then federate Azure AD and Azure AD B2C.
Your other option is to use an IDP that does allow authentication via an API e.g. Auth0.
Then you could have a custom login page that authenticates as appropriate.
Using Ping ID and other similar products is the fastest way to utilize SSO.
Using AAD B2C, I'd like to enable end-users to login using their Microsoft-Live or Google identity providers (delegate the authentication). However, I have a set of custom claims in AAD B2C for my users (some roles, for example). So, once the user authenticates into google, I need to add or "map, merge" the claim set with this user's custom claims in AAD B2C and return the consolidated claim-set to my application.
My question: where can I add or map these claims in the claimset returned by AAD B2C? In some Identity Providers this is possible using filters. Not yet finding the feature in AAD B2C, pointers?
EDIT: found this:
- https://aadguide.azurewebsites.net/claims/#claim-augmentation-/-enrichment
I've been messing around with MSAL having previously used ADAL for sign up & secure API calls within AAD
I have a user case now requiring sign up and sign in but bafflingly MSAL - even tho there's a method for returning user name - is incapable currently of returning you anything about the user from the B2C token
The workaround seems horribly contrived so I'm considering abandoning MSAL and going back to ADAL or other providing the Sign Up or Sign in is also available
Can anyone recommend me a library or method of achieving Sign Up directly into AAD using ADAL or other please?
is incapable currently of returning you anything about the user from
the B2C token
ADAL supports for v1 endpoint.B2C uses v2 endpoint, and the MSAL is designed to support v2, so you could not use ADAL for the B2C Sign Up. If you want to get user information in the token, suggest you use the OpenId Connect. In the OpenId Connect, the id_token includes the user information.
You could use jwt.io to parse the id_token, and you could find username in the id_token:
For the details about OpenId Connect in B2C, please read here.
ADAL and MSAL are incompatible
MSAL doesn't support Graph
OpenID Connect needs an authorisation code so isn't appropriate for the workflow
The answer I figured out was to install ADAL into my API, then when the user logs in on the app send securely the GUID from the token to the API which can then communicate with the Graph and return user profile info
Completely new to B2C. Tried both of these walkthroughs, but I'm missing something still:
https://github.com/Azure-Samples/active-directory-b2c-advanced-policies/blob/master/Walkthroughs/RP-SAML.md
http://blogs.quovantis.com/saml-based-sso-with-azure-ad-b2c-as-an-idp/
Both of these only describe the policies needed, but I'm pretty sure I need to register an app on B2C still? The problem I have with app registration is that SalesForce gives me a token endpoint URL with a query string:
https://mycompany.cs79.my.salesforce.com/services/oauth2/token?so=00D1h000000Cnli
And B2C won't allow query strings in the reply URL.
Is there any way around this? Salesforce also supports OpenID I think, if that would be better?
::::::::::::UPDATE 6/22::::::::::
SAML:
I found and realized I was missing a critical step on the SalesForce side: adding the authentication provider to my domain's login page. Clicking the new link redirects me to B2C, but I get an immediate error from B2C. Application Insights shows the following exception:
The SAML technical profile 'serviceProviderMetadata' specifies a PartnerEntity URL of 'REMOVED', but fetching the metadata fails with reason 'For security reasons DTD is prohibited in this XML document. To enable DTD processing set the DtdProcessing property on XmlReaderSettings to Parse and pass the settings into XmlReader.Create method.
OpenID:
Using this write-up as a guideline, I've registered the app in B2C and configured the SalesForce side.
Instead of using the Azure AD authorization endpoints, I pulled my B2C tenants endpoints from my meta data URL (login.microsoftonline.com/{tenant}/.well-known/openid-configuration).
This works for my B2C admin account, however, when I try try a test user that isn't a B2C admin I get the following error from the B2C sign-in page:
Sorry, but we’re having trouble signing you in.
AADSTS50020: User account 'REMOVED' from identity provider 'LINK REMOVED' does not exist in tenant 'MTB2CTest' and cannot access the application '5c8b9f4f-cf28-42fe-b629-b87251532970' in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.
::::::::::::UPDATE 6/23::::::::::
OpenID:
I’ve found that it works 100% only for my B2C admin account if I don’t use a policy, but doesn't work for other accounts. When I use a policy, only accounts that signed up through the policy can authenticate with B2C (which is great) – but the token doesn’t seem to be reaching SalesForce. I've created two PDFs showing the configuration details and the results from each method (policy and nopolicy) here.
Both of these only describe the policies needed, but I'm pretty sure I need to register an app on B2C still?
Not exactly, you no need to register an app at B2C side. All the configuration you do in Policies is enough.
Did you try Salesforce SAML SSO article https://help.salesforce.com/articleView?id=sso_saml.htm&type=5
Check the above article and try to do configurations at Salesforce side and grab the details required by SAML RP
I hope by following both SAML RP and Configure SAML Settings for Single Sign-On articles you can configure B2C as IDP for Salesforce.
I stumbled on this question while trying to implement Azure AD B2C as an IdP for Salesforce. We used Open ID Connect to enable SSO between the two. This involved setting up an Application in Azure AD B2C, enabling the read scope on that application, and configuring the connection in Salesforce using that application, a custom policy returning a JWT token, and a dummy User Info endpoint.
Check out this answer for exact steps on how we set up Open ID Connect: https://stackoverflow.com/a/61639332/13484109