We plan to use Azure AD for our workforce users. We also have few applications for our customers. The sales team usually reaches out to a specific team who creates customer accounts to our current environment.
Few questions:
a. Is Azure AD B2C right to use for the customer applications? What I mean is should we use B2C only when the application is like a shopping application or something where we talk about huge number of users who self-registers and perform all activities.
b. We do not need self-registration, but we want our customers to verify and confirm their email address. How do we achieve that?
c. Does Azure AD B2C support accepting terms and conditions at the time of login? I know Azure AD conditional access policy does.
d. If an on-prem application supports OAuth 2.0, is there anything still need to be updated in the app to integrate with Azure AD B2C? Is the integration approach any different than Azure AD?
e. Can we have more than one application in one Azure AD B2C tenant? Can we have separate sign-up or sign-in flow for individual applications?
f. Is there a way to sync password from Azure AD B2C to a LDAP server? we want to use Azure AD B2C SSPR.
a) B2C is designed for any non-corporate application i.e. users are not domain-joined. The number of users doesn't matter.
For what follows, you need to use custom policies.
b) Yes, you can have a sign-up flow that simply asks for email and verifies it.
c) Yes, see here. There are a number of samples there. Well worth looking at.
d) It depends on what OAuth stack the on-premises app. uses. Ideally, the app. would use the MSAL stack. It's similar to Azure AD but there is an extra parameter for the policy.
e) Yes and yes.
f) Yes, you can call a REST API that talks to the LDAP server. However, the out of the box B2C SSPR resets the password in B2C. Not sure why you need LDAP? B2C does not support AAD Connect.
Related
I have an requirement to implement both Azure B2C and B2B in a single application where B2C is used to login/signup, after user's login/signup the B2B is used to get Microsoft Intune Access??? is that possible to implement this flow?? any help will be appreciated.
Yes you can add multiple providers to most applications, for example if you use API's and azure functions or webapps etc, this can done either with EasyAuth or in your own code.
In simple terms you end up adding AAD as one provider and B2C as a second provider, meaning that your application will trust tokens from both services and then you go from there.
I'm exploring options I have when it comes to implementing user authentication and authorization in Angular app with ASP.NET Core 3.1 backend that will be deployed to Azure AppService.
Only selected, invited users will be allowed to use application. There will be no "Create account" page accessible to everyone. There is a possibility that subset of those users will be our company users so leveraging their Active Directory identity and allowing SSO would be great. Application will be multi-tenant. Multi factor authentication might be needed for selected tenants/users (based on role for example). We don't want to allow logging in with 3rd party Identity Providers like FB, Google and so on.
Based on my explorations on I have 2 (4?) options.
ASP.NET Core Identity - simple, builtin, well known. But probably won't allow me to to implement SSO and users will need another login/pass. I'm not sure if it supports inviting users (out of the box) or is this something I would need to implement myself. Same with password resets. It allows me to add custom properties to stored user entity (TenantId) to allow me to implement multitenancy, but I need to deploy SQL Server database and manage it myself.
Azure AD (B2B, B2C) - this is new to me. How I understand it is that with Azure AD Connect I could synchronize users between AD and Azure AD and this would allow me to implement SSO for our company users. Only selected OU's could be synchronized and based on groups in AD they could be assigned different roles in our app. Then assigning roles is responsibility of people which are already managing those users in AD. If person is released and their account is removed/locked in AD they lose access to our app. If they're removed from specific group they lose access to our app. And probably all our company users are already in Azure AD - I see myself and my colleagues in it when I use my work e-mail to login to Azure portal. When it comes to supporting users which are not in our AD I tested that I can add "Guest users". At first I thought this is something I would need Azure AD B2C for but looks like it's not the case. Then what is Azure B2B and B2C for? In this case I don't need to manage SQL database and have user managment for free. Both on AD and Azure Portal site. I don't know if I can add custom properties to users (TenantId).
Which one of those options is better? Maybe there are other options?
Azure AD B2B is indeed the way to go for your requirements.
B2C is required when you would like to open up your application to external users while allowing them to login using social providers.
You can read more about the differences between Azure AD B2B and B2C.
I have an Azure AD B2C tenant and with that i have implemented sign-in/sign-up flow in multiple applications and all are hosted.
In those applications some premium applications are restricted which means who bought some membership from our portal can only access it but the problem is whoever registered with our other applications (via AD B2C) can able to access the premium applications too.
The B2C tenant allows all users to access all applications. How to restrict some users who not having our membership from accessing premium applications?
Note:
In Azure AD, Enterprise Application option used for Role Based Authorization but i dont see equivalent option in AD B2C.
With built-in user flows you'd probably have to do the check in the app itself. With custom policies, you could implement a validation technical profile to the login flow. But going to custom policies just for that isn't worth it in my opinion.
As juaans mentioned, there is no direct way in built-in user flows. But there is a way which can make it easier. If the membership is stored as a custom attribute, the apps get the membership in a claim in the token. Once you have it in the token, its a very simple check in the authorization layer of the app. I am assuming app will be implementing some authorization for sure.
I have what seems on the face of it a simple requirement when using Azure AD B2C. I have two applications (App A and App B) registered in Azure AD B2C. I want to restrict access so that User 1 can access both App A and App B, but User 2 should only be able to access App A.
I can register appRoleAssignments and assign them to a user via the Azure AD Graph API with a zero id as per this question When a user logs in, I can then query these and restrict access myself, but it feels like I'm reinventing the wheel and this should be provided by B2C.
Is this something Azure AD B2C is able to provide out of the box?
Azure AD B2C does not currently have first class support for application assignments.
As you've indicated, you'll need to implement this yourself.
You can request this feature in the Azure AD B2C Feedback Forum
I think the way you are doing it is the correct way, eventually Azure B2C will support role and group claims and this extra step wont be needed.
We are designing an application which will be used by client's employee, some of their vendors and consumers as well. All of these three types of user will have the different set of rights.
We were analyzing the Azure AD and found that Azure B2B can be used for employees and vendors whereas B2C can be used for consumers. So, we need both of them. Can we setup our application in such a way that if can authenticate from B2B and B2C both? Or any other suggestion to implement this.
Thanks In Advance
You can totally setup an app to authenticate with multiple directories.
Setup one Azure AD that will be used by employees, where partners can be added through B2B. Then also setup a B2C directory for the customers.
On your app side you need to display a choice for the user: if they want to sign in as an employee/partner or as a customer. Then you redirect to the correct sign-in page.
You'll need to define the app twice, once in both directories.
The actual implementation will vary based on your tech stack, but in ASP.NET Core you would need to setup multiple Open ID Connect middleware. And none of them can use AutomaticChallenge, as you do need to know where to redirect the user, you can't really choose for them.
Update to B2C allows you to do it all from there now
Azure AD B2C now allows custom policies (preview feature). This means you can use any OpenId Connect provider for sign-in, including Azure AD of course.
This new feature allows you to:
Create a B2C tenant with custom policy for employee/partner login through Azure AD
Send all users to authenticate with your B2C tenant
Users can choose if they want to sign in with social accounts or if they are an employee or partner
If they choose to sign in as employee or partner, they would be redirected to your Azure AD
In the end your app gets a token from B2C telling where the user signed in, so you can then do authorizations based on that info