Within the InfoQ or IBM CodeRally pages, is there a way to check / reconfirm the account details entered during registration process? Having used Google OAUTH, can one also provide twitter OAUTH details?
The only way to confirm which social media account is linked to a username is to try and login with them.
You cannot link more than one OAuth login to the same username, but one OAuth login can be linked to as many usernames as you like. If you want to use a different OAuth to the one you registered with you will need to go back to InfoQ's page and register again with a different username and your preferred social media account login.
Related
We have below requirement:
We are creating B2C users (with random password) using Graph API from our Asp.Net Core Web API.
We want to send welcome email to the user along with some link so that user can directly launch the "Password Reset" page and then can login to his application after setting the password.
As per my research, Different Solutions and their cons:
User login and follow the forgot password journey from login but that's bit annoying for new users. How would they know that they have to follow forgot password journey on 1st login.
Implement "Forced to reset password on 1st Login" policy - but for this policy, user should know his initial password.
Using REST API - we can't use REST api in custom policy as we are creating user using Graph API.
Is there any better way to send email to user on creation(using graph API)?
Any help is much appreciated.
Thanks in advance,
Anu
You can send out an "invite" link via email after creating the account via Graph API, which, when the user opens from their inbox, they can use it to set a new password at AAD B2C, and are immediately logged in to the app once completed (or you can do other things in the journey if you like).
This uses the id_token_hint concept demonstrated here.
I am struggling to get my head around how to implement a custom policy for the following flow:
User lands on the login page and that login page only contains an email input.
User enters email address and clicks continue
if user has already registered
Redirected to their selected login provider (Google, Microsoft Account or Local Account)
if user has not registered before
Check google provider if a user account exists for that email address
if Google account exists
Redirect to Google login
Check Microsoft provider if a user account exists for that email address
if Microsoft account exists
Redirect to Microsoft login
else
Redirect to registration screen
User completes registration screen
User is automatically logged in
The user
I've investigated whether this can in fact be done and I've found a "digital workspace for visual collaboration" (a.k.a Mural.co) that does in fact implement a similar flow, so this has to be possible. See the pictures below.
I'm, however, unable to find information on
how to query the social providers for account existence
how to go about creating this complex type of flow in Azure AD B2C custom policies.
Any pointers in the right direction would be greatly appreciated
Not possible. Nobody would allow you to probe a social IdP for an email. Data protection etc.
Reference our samples and wiki
Your sign up would be from our default sign up journey.
Your sign in flow could work like this:
Request for email
Read the directory to see if an email exists
If email exists, send the user to the IdP they used to sign up. You can do that by looking at the “issuers” registered on the userIdentity object,
If email doesn’t exist, send the user to the combined sign in and sign up page (technical profile) where they can sign in with social or sign up with a local account. Hide the sign in elements with CSS.
I would like to pre-register a limited number of users which can use my application.
This are the requirements:
Users should be able to reset their password on their own
No other users than the preregistered users can sign up
Ideally, the user can choose the login email address by himself (no #app.onmicrosoft.com login).
Now I'm having trouble to have all requirements fullfilled together.
I was able to preregister #app.onmicrosoft.com users in the Azure Portal. But since the user can't get emails on #app.onmicrosoft.com, a password-reset-policy would not make sense. I tried to specify alternate-email and a phonenumber in the user-profile, but unfortunately the password-reset-policy is not using it for verification.
Let's say I create a sign-up policy: This is nice - the user choose his own email. Password resetting would also work. However, I can't control who's signing up and getting valid access tokens. In the portal, under Enterprise Applications, I found my registered application (All Applications) where I can set an option "User assignment required?" to true. But this does not seem to work in the B2C context, right? I expected, that until I assign a user to this application, the user is not getting a token on sign-in, but this wasn't the case. Here I found a similar question about creating users. Any advice on creating users including passwords etc. using Microsoft Graph (since it's recommended to use it over Graph API)?
I also tried to invite users as guests. They have to create a microsoft account, resetting passwords would be solved through microsoft, but unfortunately, no redirect to microsoft login happens after entering the microsoft account email address.
Deleting the signup policy after initial registration is a bad option if more users have to be onboarded.
Ideally, I would like to preregister users as if they signed up by their own - but with no signup policy.
Any advice? What do I miss?
You can implement the activation/invitation scenario that is described here and implemented here.
This scenario activates/invites a new user by creating/pre-registering a local account in the Azure AD B2C directory through the Azure AD Graph and then sending a signed redemption link to the email address for this local account.
This redemption link directs the new user to the Password Reset policy.
Currently creating users in a B2C tenant with a "local account" is not supported in Microsoft Graph. For this you'll need to use Azure AD Graph for now (see creating a user with a local account). Please see this blog post for details and line item 12 in the table.
We hope to add this capability as soon as we can to Microsoft Graph.
Hope this helps,
I have a closed-registration site (set up as a resellers control panel).
There is no way to sign up externally as the admin creates the accounts and dishes them out to users.
I wanted to allow the user to attach their social accounts (fb/twitter/etc) to their logins after they have been created to make it easier for them to sign in to the website in the future.
The problem I'm seeing is that there doesn't appear to be a way to modify the third party providers to only allow login if the account already exists?
I've looked around the documentation and can't find anything eg,:
http://msdn.microsoft.com/en-us/library/microsoft.owin.security.twitter.twitterauthenticationoptions_properties(v=vs.113).aspx
So the question is - can you setup asp.net identity 2.0 so that external login providers can be used to login but are rejected if they aren't already registered to an account on the site?
I'm using the default MVC 5 template. I have a list of authorized users in a separate table from the Identity users table. When a user attempts to log in via Google, I check the user against that table in the AccountController's ExternalLoginCallback method prior to the SignInManager.ExternalSignInAsync() call. If they exist in the authorized users table, it continues the login process. If not, it redirects them back to the Login page. This of course requires knowing what their social login username or email address is in order to compare it, which in our case is not a problem because we are limiting login to specific users within our Google Apps domain.
I have an existing application that has standard user accounts, and we've just finished integrating Facebook login as an option. It works quite well, but if someone tries to login using Facebook for an email address that already exists as a user of the system, I'd like to associate them with the existing user account.
Before I go ahead and do that, though, is it safe to just do it, without requiring that the user login first? If Facebook says a user has a certain email address, how confident can I be that it's not fake?
I could, if required, set it so that the user needs to login to my app, then associate the Facebook account manually, but I'd prefer to keep it as simple as possible for them, without adding all kinds of steps.
Thoughts?
I think the best option would be having the user login into their account on your site before associating the Facebook account.
Assume a condition that a user on your site does not have a Facebook account associated with the email address they use to identify themselves on your site. A malicious user creates one using their email address, goes to your site to associate accounts, and takes over the original users account.
I believe Facebook does not require email address authentication to use the account.