We have chosen Azure AD for authenticating users for the Enterprise Web applications developed using MVC and hosted on Azure Cloud Platform.
We are trying to plan & develop a common portal for the users to which they can login using Azure AD login screen. This Portal will display the links to the cloud applications to which the user has access and they could access the cloud application from this portal.
Please let me know whether this is feasible since I have read in many places that the Azure AD token assigned to the user from Azure AD is valid only for one resource or registered application. Does that mean that when they try to login into another Cloud application registered to the same Azure AD from the portal, they will need to login again or re-use the Azure AD token for the portal in the browser session cookie for logging into the other applications?
It's true that your users authenticate against an application registered in Azure AD and that the issued token is only valid for that application.
However, the user establishes a session with the authorization server (Azure AD) and will not be prompted for credentials when redirected there to authenticate against another registered application.
So your portal page can just contain links to the URLs for the applications. Each application redirects the user to Azure AD for authentication and the user is only prompted for credentials for the first application he/she logs in to.
Related
We have an Azure AD B2C registered web app and an Azure AD registered Web API - is it possible to make authenticated calls to the Azure AD Web API from the Azure B2C Web app? Can it be done?
We have tried a few different ways but not having much luck - including Access Control Lists but it doesn't accept the token passed as says it is invalid.
You must register two applications in the Azure AD B2C directory to enable your app to sign in with Azure AD B2C and call a web API.
Your app can sign in with Azure AD B2C via the web, mobile, or SPA application registration. The Application ID, also known as the client ID, is generated during the app registration process and uniquely identifies your application (for example, App ID: 1).
Your app can use the web API registration to call a protected web API. - The web API permissions (scopes) are exposed as part of the registration . The Application ID is generated during the app registration process, and it uniquely identifies your web API (for example, _App ID: 2 ).
For more information, please refer this link.
We are developing a multi-tenant application that is hosted in Azure. We're using IdentityServer4 for handling authentication and authorization. Recently, we enabled the SSO by registering our application in Azure AD. We enabled the multi-tenant SSO in the App registration service. The SSO works fine and client users can sign in with their Azure AD.
The users are accessing the application by providing the URL in the following format https://myapplication.com/mytenant. When a user logs in for the first time consent is required and if accepted the user can successfully log into its tenant space.
After the first successful access, our application is added to the My Apps portal in Azure.
Our problem is that the URL in My Apps is pointing to the one provided in the Branding tab in App registration but not the one that the user logged in for the first time. Since this is a multitenant application every tenant has its own URL.
Is it possible for the first sign-in URL to be saved in the My Apps portal? We can do an Azure tenant - application tenant sync based on claims but that means a lot of trouble just for accessing the My Apps portal.
An administrator of each customer could add a linked "single sign-on" app in their organization and assign it to users, but there's no way to have your single multi-tenant app present in different tenants with different URLs.
What you could do instead is to have your (only) sign-in URL be a URL that triggers a sign-in (generically, on the "common" or "organizations" endpoint, instead of a tenant-specific endpoint). Once the user has signed in, then you'll know what tenant the user belongs to, and you could redirect them to the appropriate version of your site.
I am working on setting up Tableau server. I want end users who login with their Azure AD B2C credentials to see some of the visualizations we build in Tableau.
While setting up Tableau, I noticed that Tableau works with Azure AD Domain services only. Two of our user groups in Azure AD is synched with ADDS. So I am able to add those users to Tableau.
However, I do not see similar synchronization option between ADDS and AD B2C.
Question: ADDS is only for Azure AD and not for AD B2C? Any suggestions to achieve my goal mentioned in first two lines?
From official documentation
Azure Active Directory Domain Services (AD DS) provides managed domain services such as domain join, group policy, lightweight directory access protocol (LDAP), and Kerberos/NTLM authentication. You use these domain services without the need to deploy, manage, and patch domain controllers (DCs) in the cloud.
it is meant as a mean to help customer that are using active directory on premise to migrate their domain controllers to Azure domain services and still support authentication and traditional management using OU, LDAPS and Kerberos.
https://learn.microsoft.com/en-us/azure/active-directory-domain-services/overview#:~:text=Azure%20Active%20Directory%20Domain%20Services%20(AD%20DS)%20provides%20managed%20domain,(DCs)%20in%20the%20cloud
Azure B2C
Azure Active Directory B2C (Azure AD B2C) is an identity management service that enables custom control of how your customers sign up, sign in, and manage their profiles when using your iOS, Android, .NET, single-page (SPA), and other applications.
basically this is meant to support modern authentication for applications using OIDS,OAuth2, SAML
https://learn.microsoft.com/en-us/azure/active-directory-b2c/#:~:text=Azure%20Active%20Directory%20B2C%20(Azure,SPA)%2C%20and%20other%20applications.
so you cannot use AADS (Active Directory) to manage B2C authentications.
to configure Tableau with Azure Active Directory I suggest you use SAML as described in official documentation:
Tableau SAML
https://help.tableau.com/current/server/en-us/saml.htm
Azure B2C SAML
https://learn.microsoft.com/en-us/azure/active-directory-b2c/connect-with-saml-service-providers
you should have something like the below
User navigates to the Tableau Server sign-in page or clicks a published workbook URL.
Tableau Server starts the authentication process by redirecting the client to the configured IdP (Azure B2C).
Azure B2C requests the user’s username and password from the user. After the user submits valid credentials, Azure B2C authenticates the user.
Azure B2C returns the successful authentication in the form of a SAML Response to the client. The client passes the SAML Response to Tableau Server.
5.Tableau Server verifies that the username in the SAML Response matches a licensed user stored in the Tableau Server Repository. If a match is verified, then Tableau Server responds to the client with the requested content
I have registered an application in Azure AD portal for oauth and working fine with my web application www.test.com.I have a concern that , the token generated by the client id and secret can be used in another application say www.otherapp.com.Is there any way to restrict that the app can only be used by www.test.com.
Unfortunately, there is currently no way to limit the Azure AD App to your application. If you are concerned that other users in the tenant will use the Azure AD app that you have registered, you can set the application to only specific users. You can Refer to this here.
We have the following scenario:
an Angular app accessing a Web Api backend
our own user database
We are planning to use a third-party identity solution such as Azure AD B2C, AWS IAM or Auth0. To my surprise, I found that Auth0 has an integration with on-premise Active Directory, but Azure AD B2C seems not to support this (at least not that I could find out)
We want to get to the following scenario:
an Angular app accessing a Web Api backend
third-party identity solution that manages the users of the angular app (preferably Azure AD B2C)
users need to authenticate via the identity solution (e.g. using a social account)
some users are in an existing on-premise AD and also need to be able to access the angular app
So my problem basically is : if we would use Azure AD B2C, how can we let users that are defined in an on-premise AD, authenticate in our Angular app? Or with other words: can an on-premise AD be an identity provider for Azure B2C?
This scenario can be solved with AD B2C custom policies.
I found that Auth0 has an integration with on-premise Active
Directory, but Azure AD B2C seems not to support this (at least not
that I could find out)
One way I know to make this work through ADFS. Where you can Integrate ADFS in B2C. I will update this answer if I know any other way of doing this.
Update Start
You can use Shibboleth and Okta servers apart ADFS server.
Update End
users need to authenticate via the identity solution (e.g. using a
social account) some users are in an existing on-premise AD and also
need to be able to access the angular app
If you use custom policies, you can achieve all of these scenarios. You can integrate both social accounts and AD via ADFS (On Premise ADFS server which give access to On Premise AD users)
if we would use Azure AD B2C, how can we let users that are defined in
an on-premise AD, authenticate in our Angular app? Or with other
words: can an on-premise AD be an identity provider for Azure B2C?
As I said this is possible through ADFS server. All you need to do is enable ADFS service on your server and add Relying Parties and make B2C consume and allow your AD users to login with B2C.
Warning: If at all your server not have ADFS enabled first try it on other test server.
ADFS in custom policies can found at: https://learn.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-custom-setup-adfs2016-idp