I have 4 Node.JS Application frontend angular with different domains, I have implemented Azure AD B2C
I need to implement SSO or Single Sign On in my applications
How can I set it up, what is the recommended way.
I checked https://github.com/AzureAD/passport-azure-ad
but there is no documentation on setting up SSO for Node.JS applications or sample codes.
Go to Azure AD B2C->User flows(policies)->find your sign in policy->properties->you will find the single sign-on configuration.
The default setting is tenant which allows multiple applications and user flows in your B2C tenant to share the same user session. For example, once a user signs into an application, the user can also seamlessly sign into another one.
Reference:
Configure session behavior in Azure Active Directory B2C
Related
Is it possible to configure msal to work with two different apps simultaneously? Or perhaps is it possible to have two instances running in parallel on the same Single Page Application SPA?
Specifically, I have a business app that is accessed by both B2C users and Corporate users. The business prefers that the Corporate users be able to log into the app without the need to create an additional B2C account (and using a federated B2C sign-in type). This would mean that I need an app in the B2C tenant and the Corporate tenant, and my single page application app would be protected by either app for any given user.
In other words, if you follow this link:
https://github.com/Azure-Samples/ms-identity-javascript-angular-tutorial#chapter-1-sign-in-a-user-to-your-application
it gives instructions for how to sign in with Azure AD, and how to sign in with Azure AD B2C. But how would I go about doing both at the same time?
We're considering to use Azure AD B2B OR B2C for SSO service. We will not be using Azure B2B built-in SSO login page OR B2C custom-policies based login page. We've our own custom login JSP page that we plan to use MSAL Graph APIs for calling Azure AD authentication services.
Questions:
Is this MSAL APIs applicable to B2C only, or can we use this with B2B tenant application as well? All the documents and guidance that I can take as an example uses B2C tenant app only.
If I am using MSAL OAuth 2.0 authentication services for my custom login page, I assume we don't need to rely on SAML SSO configuration. Or would it be possible to use mix of these services (i.e. SAML for basic login authentication, MSAL OAuth2.0 calls for self service account registration)?
I appreciate if anyone can shed some light on this.
Thanks.
B2B and B2C serve two different purposes. B2B is meant for you to use to invite external federated users to your directory using their own credentials whereby you can assign them access directly to your resources. On the other hand, B2C is a separate directory where you allow users to register, optionally using their own credentials from federated providers as well. If your aim is to SSO to a local AzureAD protected resource, then clearly you're going to have to tell that resource to use the B2C directory as an IdP as well. Hence, B2B is much simpler for SSO, but a big differentiator is scale. If you plan to invite a massive number of users, then this it is not a good idea to user B2B.
MSAL uses standard protocols such as OAuth 2.0 and OIDC to authenticate directly to any supported IdP, including Azure AD or Azure AD B2C. Being a guest user or not has no bearing on that process. It is also important to mention that B2C does require either a User Flow or a Custom Policy to function.
So to answer your questions to the best of my ability:
1- MSAL libraries work similarly for both Azure AD and Azure AD B2C. There may be some configuration differences in case of B2C to supply additional information regarding the policy name, etc. But they work all the same.
2- MSAL itself does not support SAML authentication. For that you'll need a library which can perform SAML authentication. While Azure AD supports SAML natively, Azure AD B2C requires you to setup a custom policy to configure SAML authentication.
I have two applications: let's say application A and application B that are running on different ports i.e. 6420 and 8000.
Theses applications are registered in the B2C tenant and are using the same 'signInUp policy'.
I am able to authenticate the user with MSAL.js (Microsoft Authentication Library).
Kindly let us know what needs to be done at code end for SSO implementation on different domain applications.
In a B2C policy, you can control the SSO experience per Policy. In the "Token, session & SSO config" part you can configure the SSO behavior:
In this section you can limit the SSO to:
Tenant (every application in B2C)
Application (SSO through different policies on the same app)
Per policy
Disabled (No SSO)
This documentation and Github sample show you how to set up the SSO:
https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/active-directory-b2c/active-directory-b2c-token-session-sso.md
https://github.com/Azure-Samples/active-directory-b2c-advanced-policies
See also: https://github.com/Azure-Samples/active-directory-b2c-dotnetcore-webapp
I'm using Azure OpenID Connect with Active Directory B2C multi-tenant application for login purpose on my set of applications. Most of the users login using Google social provider of B2C, but for now I'd like to keep the option to use AD open. I use a single B2C application to login to multiple sub-parts of my applications, using different domains, different programming platforms etc - I just allow many return URLs in the B2C app.
What I'd like to achieve is a true single sign-on: possibility to login once and then to access all the sub-applications that use this B2C app.
Currently, when I login to one sub-app and then try to access some other one, I need to choose my Google account (when I'm logged in using Google connector). I'd like to remove the necessity of any human interaction in the process of accessing other parts of the app, when I'm already signed in (of course automatic redirects are fine). Is this possible with B2C/OpenID Connect?
I am using Custom Policies on Azure B2C.
When I want to run the Custom Policy I can choose the application which I want to use with the policy. I saw that I'm not only able to use my applications from Azure B2C, I can use the applications from the App Registration section.
What is the differences. I've been able to signup and sign in users with both types of applications.
Thanks in advance!
The two sets of apps are completely independent of each other.
You should not be able to see any of the Azure AD B2C apps in the Application Registration in Azure Active directory.Also, the apps in the Application Registration should not be visible in the B2C .
In your issue , I assume that you should have add two apps in the two places.
What is the differences.
Application in Azure AD B2C :To build an application that accepts consumer sign-up and sign-in, you first need to register the application with an Azure Active Directory B2C tenant.
Application Registration in Azure AD: This creates an Application ID for the application, and enables it to receive tokens. In order to get a client ID and secret from Azure, you have to register the app and provide some basic information about it, including what resources your app wants to access, and what permissions it needs.
Depending on your scenario, you could register an application in both portals, and use the right one depending on the request you need to make.
The apps that are registered through each different location (Azure Active AD versus Azure AD B2C) are given credentials that are valid for any policy, including custom policies you have uploaded.
The end result is the same: you have an application that is registered with and can access the policy regardless of how that app/policy was created.