We want to implement b2c SSO using custom policies on following scenario:
User logs into web app using b2c signin-singup policy (works fine).
After signin, web page displays links to call another web apps and when signed in user clicks on link, he/she should be able to access without signin using SSO.
One app is hosted on aws and others are hosted in azure.
Is there any github sample or documentation which walks through above scenario (Azure B2C SSO with AWS App)?
Thanks
Related
We are developing a multi-tenant application that is hosted in Azure. We're using IdentityServer4 for handling authentication and authorization. Recently, we enabled the SSO by registering our application in Azure AD. We enabled the multi-tenant SSO in the App registration service. The SSO works fine and client users can sign in with their Azure AD.
The users are accessing the application by providing the URL in the following format https://myapplication.com/mytenant. When a user logs in for the first time consent is required and if accepted the user can successfully log into its tenant space.
After the first successful access, our application is added to the My Apps portal in Azure.
Our problem is that the URL in My Apps is pointing to the one provided in the Branding tab in App registration but not the one that the user logged in for the first time. Since this is a multitenant application every tenant has its own URL.
Is it possible for the first sign-in URL to be saved in the My Apps portal? We can do an Azure tenant - application tenant sync based on claims but that means a lot of trouble just for accessing the My Apps portal.
An administrator of each customer could add a linked "single sign-on" app in their organization and assign it to users, but there's no way to have your single multi-tenant app present in different tenants with different URLs.
What you could do instead is to have your (only) sign-in URL be a URL that triggers a sign-in (generically, on the "common" or "organizations" endpoint, instead of a tenant-specific endpoint). Once the user has signed in, then you'll know what tenant the user belongs to, and you could redirect them to the appropriate version of your site.
Context
I've successfully created and configured a Azure B2C tenant and a ASP.NET Core 3.1 Web Application which uses AD B2C built in workflows to authenticate users.
Question
In the application described above the login forms (even they have customized design by me) are provided and hosted by Azure AD B2C infrastructure.
Is it possible to use my entirely custom login form (hosted in my web app), get the typed credentials from the uses, then call Azure AD B2C API to do the authentication, and get the token?... or it is not a supported scenario and asking for the credentials form is always must be hosted by the Azure AD B2C infrastructure...
From a web app this is not supported. We do support an ROPC flow from mobile apps.
I want users of my application authenticated in a couple of on-premises ADFS servers.
I setup Azure B2C working together with ADFS as SAML identity provider.
The setup process is described here in MS official docs https://learn.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-custom-setup-adfs2016-idp
That was complicated, but now my custom policy B2C_1A_SignUpOrSignIn works, in meaning that it redirects to B2C login page with buttons first, then I click a button and system redirects to ADFS login page, where asks users for login and passwords.
But how to integrate it with a .NET or Node.js application?
Any code examples?
Samples for different platforms can be found at Azure Active Directory B2C code samples.
If a sample application references a built-in policy, such as "B2C_1_SignUpOrSignIn", then you must replace this with your custom policy.
I'm pretty new with Azure and all its services and I want to use Azure B2C to provide authentication to local users and FB providers. However, I noticed that I cant use the workflow I have defined in my mobile app because Azure has a redirect URL to load a browser and show the web page defined by them or custom according to the policies defined for sign in.
I've been googling for a while but doesn't seem there's an option to have a webAPI that receives data from the mobile app and authenticate against the Azure B2C.
Does anyone know if there's a way to not use the redirect URL and use the app login workflow?
Thanks!
Currently, Azure AD B2C doesn't have support for this.
However, work to support for the Resource Owner Password Credentials flow in Azure AD B2C is in-progress.
This new feature will enable the mobile app to collect a user credential and POST it to the B2C tenant for validation.
We have chosen Azure AD for authenticating users for the Enterprise Web applications developed using MVC and hosted on Azure Cloud Platform.
We are trying to plan & develop a common portal for the users to which they can login using Azure AD login screen. This Portal will display the links to the cloud applications to which the user has access and they could access the cloud application from this portal.
Please let me know whether this is feasible since I have read in many places that the Azure AD token assigned to the user from Azure AD is valid only for one resource or registered application. Does that mean that when they try to login into another Cloud application registered to the same Azure AD from the portal, they will need to login again or re-use the Azure AD token for the portal in the browser session cookie for logging into the other applications?
It's true that your users authenticate against an application registered in Azure AD and that the issued token is only valid for that application.
However, the user establishes a session with the authorization server (Azure AD) and will not be prompted for credentials when redirected there to authenticate against another registered application.
So your portal page can just contain links to the URLs for the applications. Each application redirects the user to Azure AD for authentication and the user is only prompted for credentials for the first application he/she logs in to.