Can someone tell me if it's possible with the "Microsoft.Identity.Client" to do OpenIdConnect and get an access token which doesn't come from Microsoft/Azure but from another Identity Provider.
Thanks in advance.
Can someone tell me if it's possible with the "Microsoft.Identity.Client" to do OpenIdConnect and get an access token which doesn't come from Microsoft/Azure but from another Identity Provider
No, it's not possible to get an access token from third party identity provider if you are using Microsoft.Identity.Client with OpenIdConnect.
As per documentation:
With OIDC, this flow does authentication and authorization for most app types. These types include single page apps, web apps, and natively installed apps. The flow enables apps to securely acquire an access_token that can be used to access resources secured by the Microsoft identity platform.
All confidential clients have a choice of using client secrets or certificate credentials. Symmetric shared secrets are generated by the Microsoft identity platform.
You can refer to Microsoft identity platform and OpenID Connect protocol, Validating access tokens and Request an access token with a client_secret
Related
I have implemented web APIs using ado.net and uploaded in hosting, but those web APIs are not secured, anyone can access without login, and now I want to secure them with the role-based authentication how can I secure? I want to do that only a login user can access them.
You can protect your api with token authentication ,In order to acquire a token user would have have to first login in the authentication server ,acquire a token and then call the api.You can assign roles to the user so that the roles are included in token and can be validated when the token validation occurs at api level.
You can use identity server as an identity provider if you dont have a identity provider set up.
On this Microsoft documentation on Azure AD B2C, I read
OpenID Connect is recommended if you're building a web application that's hosted on a server and accessed through a browser. If you want to add identity management to your mobile or desktop applications using Azure AD B2C, you should use OAuth 2.0 rather than OpenID Connect.
What are the roles of OpenID Connect and OAuth 2.0 in Azure AD B2C and what features they separately support?
The question is not quite correct. On the same page you can read
OpenID Connect extends the OAuth 2.0 authorization protocol for use as
an authentication protocol. This authentication protocol allows you to
perform single sign-on. It introduces the concept of an ID token,
which allows the client to verify the identity of the user and obtain
basic profile information about the user.
OpenID Connect (OIDC) is an extension or superset standard/RFC for OAuth 2.0. Both protocols define authentication flows, while OAuth2 is a bit generic, a general framework, that gives a lot of freedom of choice, OIDC specifies important aspects in detail. OIDC adds id_token in JWT format in addition to access token, flows like Hybrid flow, token introspection endpoints etc to OAuth2.
Usually OAuth2 comes together with OIDC. If you want to know difference in detail then there are RFCs for OIDC and OAuth2
So your questions is about protocol difference, you can find a lot of information in addition to RFCs. Here is IMO good article link.
In short:
OAuth2
access token use but not format specified
Authorization Code Grant
Implicit Grant
Resource Owner Password Credential Grant
Client Credential Grant
OIDC
extension of access token by id_token use. id_token in JWT format
token endpoints, self issued token, offline access
Authorization Code Flow (extension to Authorization Code Grant)
Implicit Flow (extension Authorization Code Grant)
Hybrid Flow
B2C is focused on use from client application side from consumer applications. When you will be creating IdP provider Azure B2C support already existing social providers (Facebook, Microsoft etc), which in fact are OIDC with proprietary extensions, or custom OIDC IdP provider. In terms of API and authentication flows, and it is very typical for any IdP provider, it supports both, so you can use HTTP API for OAuth2 or OIDC, and OIDC is recommended.
A very common flow for applications running in Azure and App Services is the on-behalf-of flow where the app can exchange an incoming access token along with its ClientId/ClientSecret to get access to another resource as the user. Looking at the current, limited, docs on the MSI API, I only see getting an access token as the app itself.
How/when will the OBO scenario be supported?
I am aware that you could store the ClientId/ClientSecret in Key Vault and then use the MSI creds to retrieve those, but that seems redundant.
MSI does not support the On Behalf Of flow yet, or other delegated confidential client OAuth 2.0 flows with Azure AD (like the auth code flow). It is in the design process, no ETA announced yet.
I need my mobile application to allow authenticating either to 3rd party vendor (facebook, google, etc) or to my own WS-Federation identity provider (I'm using Thinktecture). Now, when logging in to my own WS-Fed idp I want to authenticate directly and pass the security token to Azure ACS (and not by using a dedicated login page). I need that because I don't want my users to authenticate using my provider by using a dedicated web page (and moving out of the context of the application).
Your help will be appreciated.
From your ACS management portal get list of identity providers of your realm from below link
https://YourNamespace.accesscontrol.windows.net/v2/metadata/IdentityProviders.js?
protocol=wsfederation&
realm=YourAppRealm&
reply_to=YourAppReturnURL&
version=1.0
Now try this:-
HTTP GET on the above identity providers link.
Parse login link of desired identity provider from the json response of above request.
Authenticate user with login link received in last step.
You'll receive your ACS Token
Note:
After step 3 user will be asked to authenticate himself and the identity provider will automatically send the authentication token to ACS, finally ACS will convert that token into new ACS token and return it as in step 4.
In this way you'll by-pass the login page and can grab ACS token in mobile application without moving out of the context of the application.
I am exposing a WCF Data Services hosted on IIS through Service Bus Relay using webHttpRelayBinding. While I could find out how to authenticate the service identity using username/password or shared secret. However, I could not find a sample how to use a certificate based credential for the service identity. I googled a lot, but in vain. All of them are based on shared secret primarily.
Could anyone please provide a sample on how to use the certificate based authentication of service identity for a REST OData service.
Currently, there are four options for authentication (according to the Service Bus docs):
•SharedSecret, a slightly more complex but easy-to-use form of
username/password authentication.
•Saml, which can be used to interact with SAML 2.0 authentication
systems.
•SimpleWebToken, which uses the OAuth Web Resource Authorization
Protocol (WRAP)and Simple Web Tokens (SWT).
•Unauthenticated, which enables interaction with the service endpoint
without any authentication behavior.
It does not look like you are able to authenticate using a certificate through Service Bus natively.