I have an ASP.Net core web application and integrated authentication using the Azure AD B2C Tenant/Application. I'm able to authenticate and get the user claims in my web application.
But what I additionally want is to allow only certain customer users access the web application. I want to do this at the B2C Tenant itself. Right now any B2C customer user can sign in. Any help, ideas, insight will be appreciated.
You may know there is an Manage user assignment for an app feature in Azure Active Directory. But it's not available in Azure B2C.
Currently the recommended way to control the access in Azure B2C is defining custom attributes and check the claims in token.
If the expected claim is included, you allow the user to continue.
Related
I have a Web API that is registered in an Azure AD B2C directory, secured by tokens from that same directory. To do that I have created an Application and created a scope.
I have a 3rd party that would also like to use this AD for their audience, who will access some of my API on behalf of the guest.
I wanted to create a new scope for this purpose and have the AD prompt the guest to allow the application to access their data on their behalf.
For some reason, when I create a scope I am only given the option of "Admin Consent". The "User Consent" fields that are shown in so many blog posts and instructions are not showing for me.
I have tried to register the 3rd Party Applications and API Applications in both the B2C blades and the AAD blades of the Azure Portal but the result is always the same.
Is there a Property or setting somewhere that needs to be ticked in order to enable User Authorized scopes?
There’s no such thing as OAuth2.0 consent in AAD B2C, only Admin consent is offered, as it’s aimed for your first party apps.
The user consent screens you’re seeing online are in regards to Azure AD, not AAD B2C.
For service partner integration, you can follow this example to create such a consent. https://github.com/azure-ad-b2c/samples/blob/master/policies/service-consent
According to this documentation, I can restrict access to applications on an Azure tenant using enterprise applications.
I tried to set this up on my B2C Tenant but when I test my user flows, I can still log in to those applications and receive an ID token.
Should the restrictions also work on the B2C Tenant or is there a different process required for B2C?
Using b2c User flows we can't restrict the user access. You need to handle this from the application side and also using Custom policy you can call the REST API in the user journey and can validate user restrictions.
I'm doing a project where we want to centralize all the user's registration in our main website using Azure AD B2C.
In our internal web application we would like to choose which Application the user who have just signed up using B2C he/she could access. For example I could give permission to a user to access an Application A but not to access the Application B, so when he/she sign-in in this application A with B2C, he/she would successfully login, but in application B he/she would not be able.
In the previous project I did with Azure AD B2C, the users who have registered in one of my application could access all my other applications.
But in this case I don't want this, I would like to choose which applications a specific user could access.
Do you know if it is possible to do with Azure AD B2C?
Thank you very much in advance.
It is doable in Azure AD B2C. You are basically looking for authorization.
Please see below answer
Authentication vs Authorization?
I'm new to Azure AD B2C so I'm not fully certain of its capabilities. Either way, I'm trying to limit the access to one of my registered applications to users from the same AD B2C tenant (single-tenant scenario). The only way I was able to do this was through the App registrations (Preview), the Legacy Application registration doesn't seem to support this.
Once I set the single-tenant option, the application starts to appear under the Owned Applications tab on the App registrations (Preview) blade but I cannot make use of it. Whenever I try to run a default or custom flow I get this error:
The provided application with ID 'XXXXXX-XXX-XXXX-XXXX-XXXXXX' is not
valid against this service. Please use an application created via the
B2C portal and try again.
I also tried to set the multi-tenant scenario (AzureADMultipleOrgs) but I still get the same error. The only way I can make this work is by using the AzureADandPersonalMicrosoftAccount which leaves the app open to everyone and that's not what I need.
Am I missing an extra configuration or is this still not supported?
Thanks!
You need to use the B2C specific Application Registration option for it to be compatible with Azure AD B2C User Flows or Custom Policies. If you then need to further restrict the user base who should be able to login to the application, then you would need to implement some RBAC, see this sample:https://github.com/azure-ad-b2c/samples/tree/master/policies/relying-party-rbac
In AAD B2C, the Application Role assignment and Application Assignment is not honored, these are Azure AD concepts that are not respected by Azure AD B2C auth policies.
We are designing an application which will be used by client's employee, some of their vendors and consumers as well. All of these three types of user will have the different set of rights.
We were analyzing the Azure AD and found that Azure B2B can be used for employees and vendors whereas B2C can be used for consumers. So, we need both of them. Can we setup our application in such a way that if can authenticate from B2B and B2C both? Or any other suggestion to implement this.
Thanks In Advance
You can totally setup an app to authenticate with multiple directories.
Setup one Azure AD that will be used by employees, where partners can be added through B2B. Then also setup a B2C directory for the customers.
On your app side you need to display a choice for the user: if they want to sign in as an employee/partner or as a customer. Then you redirect to the correct sign-in page.
You'll need to define the app twice, once in both directories.
The actual implementation will vary based on your tech stack, but in ASP.NET Core you would need to setup multiple Open ID Connect middleware. And none of them can use AutomaticChallenge, as you do need to know where to redirect the user, you can't really choose for them.
Update to B2C allows you to do it all from there now
Azure AD B2C now allows custom policies (preview feature). This means you can use any OpenId Connect provider for sign-in, including Azure AD of course.
This new feature allows you to:
Create a B2C tenant with custom policy for employee/partner login through Azure AD
Send all users to authenticate with your B2C tenant
Users can choose if they want to sign in with social accounts or if they are an employee or partner
If they choose to sign in as employee or partner, they would be redirected to your Azure AD
In the end your app gets a token from B2C telling where the user signed in, so you can then do authorizations based on that info