Skip to content

Commit 06bee3b

Browse files
LJSpillerLJSpiller
authored
Merge pull request #185892 from Gargi-Sinha/patch-105
Update partner-gallery.md
2 parents 0885b4e + b6be813 commit 06bee3b

File tree

5 files changed

+345
-0
lines changed

5 files changed

+345
-0
lines changed

‎articles/active-directory-b2c/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -331,6 +331,8 @@
331331
displayName: TOTP, time-based-one-time password, time-based one-time password, authenticator app, Microsoft authenticator app, mfa, 2fa
332332
- name: Partner integration
333333
items:
334+
- name: Transmit Security
335+
href: partner-bindid.md
334336
- name: BlokSec
335337
href: partner-bloksec.md
336338
- name: Haventec

‎articles/active-directory-b2c/media/partner-bindid/partner-bindid-architecture-diagram.png

76.7 KB
Loading

‎articles/active-directory-b2c/media/partner-gallery/bindid-logo.png

5.14 KB
Loading

‎articles/active-directory-b2c/partner-bindid.md

Lines changed: 342 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,342 @@
1+
---
2+
title: Configure Azure Active Directory B2C with Transmit Security
3+
titleSuffix: Azure AD B2C
4+
description: Configure Azure Active Directory B2C with Transmit Security for passwordless strong customer authentication
5+
services: active-directory-b2c
6+
author: gargi-sinha
7+
manager: martinco
8+
ms.service: active-directory
9+
ms.workload: identity
10+
ms.topic: how-to
11+
ms.date: 02/28/2022
12+
ms.author: gasinh
13+
ms.subservice: B2C
14+
zone_pivot_groups: b2c-policy-type
15+
---
16+
17+
# Configure Transmit Security with Azure Active Directory B2C for passwordless authentication
18+
19+
[!INCLUDE [active-directory-b2c-choose-user-flow-or-custom-policy](../../includes/active-directory-b2c-choose-user-flow-or-custom-policy.md)]
20+
21+
22+
In this sample tutorial, learn how to integrate Azure Active Directory (AD) B2C authentication with [Transmit Security](https://www.transmitsecurity.com/bindid) passwordless authentication solution **BindID**. BindID is a passwordless authentication service that uses strong Fast Identity Online (FIDO2) biometric authentication for a reliable omni-channel authentication experience. The solution ensures a smooth login experience for all customers across every device and channel eliminating fraud, phishing, and credential reuse.
23+
24+
## Scenario description
25+
26+
The following architecture diagram shows the implementation.
27+
28+
![Screenshot showing the bindid and Azure AD B2C architecture diagram](media/partner-bindid/partner-bindid-architecture-diagram.png)
29+
30+
|Step | Description |
31+
|:-----| :-----------|
32+
| 1. | User arrives at a login page. Users select sign-in/sign-up and enter username into the page.
33+
| 2. | Azure AD B2C redirects the user to BindID using an OpenID Connect (OIDC) request.
34+
| 3. | BindID authenticates the user using appless FIDO2 biometrics, such as fingerprint.
35+
| 4. | A decentralized authentication response is returned to BindID.
36+
| 5. | The OIDC response is passed on to Azure AD B2C.
37+
| 6.| User is either granted or denied access to the customer application based on the verification results.
38+
39+
## Onboard with BindID
40+
41+
To integrate BindID with your Azure AD B2C instance, you'll need to configure an application in the [BindID Admin
42+
Portal](https://admin.bindid-sandbox.io/console/). For more information, see [getting started guide](https://developer.bindid.io/docs/guides/admin_portal/topics/getStarted/get_started_admin_portal). You can either create a new application or use one that you already created.
43+
44+
## Prerequisites
45+
46+
To get started, you'll need:
47+
48+
- An Azure AD subscription. If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/).
49+
50+
- An [Azure AD B2C tenant](./tutorial-create-tenant.md) that's linked to your Azure subscription.
51+
52+
- A BindID tenant. You can [sign up for free.](https://www.transmitsecurity.com/developer?utm_signup=dev_hub#try)
53+
54+
- If you haven't already done so, [register](./tutorial-register-applications.md) a web application, [and enable ID token implicit grant](./tutorial-register-applications.md#enable-id-token-implicit-grant).
55+
56+
::: zone pivot="b2c-custom-policy"
57+
58+
- Complete the steps in the article [Get started with custom policies in Azure Active Directory B2C](./tutorial-create-user-flows.md?pivots=b2c-custom-policy).
59+
60+
::: zone-end
61+
62+
### Step 1 - Create an application registration in BindID
63+
64+
From [Applications](https://admin.bindid-sandbox.io/console/#/applications) to configure your tenant application in BindID, the following information is needed
65+
66+
| Property | Description |
67+
|:---------|:---------------------|
68+
| Name | Azure AD B2C/your desired application name|
69+
| Domain | name.onmicrosoft.com|
70+
| Redirect URIs| https://jwt.ms |
71+
| Redirect URLs |Specify the page to which users are redirected after BindID authentication: https://your-B2C-tenant-name.b2clogin.com/your-B2C-tenant-name.onmicrosoft.com/oauth2/authresp<br>For Example: `https://fabrikam.b2clogin.com/fabrikam.onmicrosoft.com/oauth2/authresp`<br>If you use a custom domain, enter https://your-domain-name/your-tenant-name.onmicrosoft.com/oauth2/authresp.<br>Replace your-domain-name with your custom domain, and your-tenant-name with the name of your tenant.|
72+
73+
>[!NOTE]
74+
>BindID will provide you Client ID and Client Secret, which you'll need later to configure the Identity provider in Azure AD B2C.
75+
76+
::: zone pivot="b2c-user-flow"
77+
78+
### Step 2 - Add a new Identity provider in Azure AD B2C
79+
80+
1. Sign-in to the [Azure portal](https://portal.azure.com/#home) as the global administrator of your Azure AD B2C tenant.
81+
82+
2. Make sure you're using the directory that contains your Azure AD B2C tenant. Select the **Directories + subscriptions** icon in the portal toolbar.
83+
84+
3. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**.
85+
86+
4. Choose **All services** in the top-left corner of the Azure portal, then search for and select **Azure AD B2C**.
87+
88+
5. Navigate to **Dashboard** > **Azure Active Directory B2C** > **Identity providers**.
89+
90+
6. Select **New OpenID Connect Provider**.
91+
92+
7. Select **Add**.
93+
94+
### Step 3 - Configure an Identity provider
95+
96+
1. Select **Identity provider type > OpenID Connect**
97+
98+
2. Fill out the form to set up the Identity provider:
99+
100+
|Property |Value |
101+
|:---------|:---------|
102+
|Name |Enter BindID – Passwordless or a name of your choice|
103+
|Metadata URL| `https://signin.bindid-sandbox.io/.well-known/openid-configuration` |
104+
|Client ID|The application ID from the BindID admin UI captured in **Step 1**|
105+
|Client Secret|The application Secret from the BindID admin UI captured in **Step 1**|
106+
|Scope|OpenID email|
107+
|Response type|Code|
108+
|Response mode|form_post|
109+
|**Identity provider claims mapping**|
110+
|User ID|sub|
111+
|Email|email|
112+
113+
3. Select **Save** to complete the setup for your new OIDC Identity provider.
114+
115+
### Step 4 - Create a user flow policy
116+
117+
You should now see BindID as a new OIDC Identity provider listed within your B2C identity providers.
118+
119+
1. In your Azure AD B2C tenant, under **Policies**, select **User flows**.
120+
121+
2. Select **New user flow**
122+
123+
3. Select **Sign up and sign in** > **Version** **Reccomended** > **Create**.
124+
125+
4. Enter a **Name** for your policy.
126+
127+
5. In the Identity providers section, select your newly created BindID Identity provider.
128+
129+
6. Select **None** for Local Accounts to disable email and password-based authentication.
130+
131+
7. Select **Create**
132+
133+
8. Select the newly created User Flow
134+
135+
9. Select **Run user flow**
136+
137+
10. In the form, select the JWT Application and enter the Replying URL, such as `https://jwt.ms`.
138+
139+
11. Select **Run user flow**.
140+
141+
12. The browser will be redirected to the BindID login page. Enter the account name registered during User registration. The user will receive a push notification to the registered user mobile device for a Fast Identity Online (FIDO2) certified authentication. It can be a user finger print, biometric or decentralized pin.
142+
143+
13. Once the authentication challenge is accepted, the browser will redirect the user to the replying URL.
144+
145+
::: zone-end
146+
147+
::: zone pivot="b2c-custom-policy"
148+
149+
### Step 2 - Create a BindID policy key
150+
151+
Store the client secret that you previously recorded in your Azure AD B2C tenant.
152+
153+
1. Sign in to the [Azure portal](https://portal.azure.com/).
154+
155+
2. Make sure you're using the directory that contains your Azure AD B2C tenant. Select the **Directories + subscriptions** icon in the portal toolbar.
156+
157+
3. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**.
158+
159+
4. Choose **All services** in the top-left corner of the Azure portal, and then search for and select **Azure AD B2C**.
160+
161+
5. On the Overview page, select **Identity Experience Framework**.
162+
163+
6. Select **Policy Keys** and then select **Add**.
164+
165+
7. For **Options**, choose `Manual`.
166+
167+
8. Enter a **Name** for the policy key. For example, `BindIDClientSecret`. The prefix `B2C_1A_` is added automatically to the name of your key.
168+
169+
9. In **Secret**, enter your client secret that you previously recorded.
170+
171+
10. For **Key usage**, select `Signature`.
172+
173+
11. Select **Create**.
174+
175+
>[!NOTE]
176+
>In Azure Active Directory B2C, [**custom policies**](./user-flow-overview.md) are designed primarily to address complex scenarios. For most scenarios, we recommend that you use built-in [**user flows**](./user-flow-overview.md).
177+
178+
### Step 3- Configure BindID as an Identity provider
179+
180+
To enable users to sign in using BindID, you need to define BindID as a claims provider that Azure AD B2C can communicate with through an endpoint. The endpoint provides a set of claims that are used by Azure AD B2C to verify a specific user has authenticated using digital identity available on their device, proving the user’s identity.
181+
182+
You can define BindID as a claims provider by adding it to the **ClaimsProvider** element in the extension file of your policy
183+
184+
1. Open the `TrustFrameworkExtensions.xml`.
185+
186+
2. Find the **ClaimsProviders** element. If it dosen't exist, add it under the root element.
187+
188+
3. Add a new **ClaimsProvider** as follows:
189+
190+
```xml
191+
<ClaimsProvider>
192+
<Domain>signin.bindid-sandbox.io</Domain>
193+
<DisplayName>BindID</DisplayName>
194+
<TechnicalProfiles>
195+
<TechnicalProfile Id="BindID-OpenIdConnect">
196+
<DisplayName>BindID</DisplayName>
197+
<Protocol Name="OpenIdConnect" />
198+
<Metadata>
199+
<Item Key="METADATA">https://signin.bindid-sandbox.io/.well-known/openid-configuration</Item>
200+
<!-- Update the Client ID below to the BindID Application ID -->
201+
<Item Key="client_id">00000000-0000-0000-0000-000000000000</Item>
202+
<Item Key="response_types">code</Item>
203+
<Item Key="scope">openid email</Item>
204+
<Item Key="response_mode">form_post</Item>
205+
<Item Key="HttpBinding">POST</Item>
206+
<Item Key="UsePolicyInRedirectUri">false</Item>
207+
<Item Key="AccessTokenResponseFormat">json</Item>
208+
</Metadata>
209+
<CryptographicKeys>
210+
<Key Id="client_secret" StorageReferenceId="B2C_1A_BindIDClientSecret" />
211+
</CryptographicKeys>
212+
<OutputClaims>
213+
<OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="sub" />
214+
<OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
215+
<OutputClaim ClaimTypeReferenceId="identityProvider" PartnerClaimType="iss" />
216+
<OutputClaim ClaimTypeReferenceId="authenticationSource"
217+
DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true" />
218+
</OutputClaims>
219+
<OutputClaimsTransformations>
220+
<OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
221+
<OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
222+
<OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
223+
</OutputClaimsTransformations>
224+
<UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
225+
</TechnicalProfile>
226+
</TechnicalProfiles>
227+
</ClaimsProvider>
228+
229+
```
230+
231+
4. Set **client_id** with your BindID Application ID.
232+
233+
5. Save the file.
234+
235+
### Step 4 - Add a user journey
236+
237+
At this point, the identity provider has been set up, but it's not yet available in any of the sign-in pages. If you don't have your own custom user journey, create a duplicate of an existing template user journey, otherwise continue to the next step.
238+
239+
1. Open the `TrustFrameworkBase.xml` file from the starter pack.
240+
241+
2. Find and copy the entire contents of the **UserJourneys** element that includes `ID=SignUpOrSignIn`.
242+
243+
3. Open the `TrustFrameworkExtensions.xml` and find the UserJourneys element. If the element doesn't exist, add one.
244+
245+
4. Paste the entire content of the UserJourney element that you copied as a child of the UserJourneys element.
246+
247+
5. Rename the ID of the user journey. For example, `ID=CustomSignUpSignIn`
248+
249+
### Step 5 - Add the identity provider to a user journey
250+
251+
Now that you have a user journey, add the new identity provider to the user journey.
252+
253+
1. Find the orchestration step element that includes Type=`CombinedSignInAndSignUp`, or Type=`ClaimsProviderSelection` in the user journey. It's usually the first orchestration step. The **ClaimsProviderSelections** element contains a list of identity providers that a user can sign in with. The order of the elements controls the order of the sign-in buttons presented to the user. Add a **ClaimsProviderSelection** XML element. Set the value of **TargetClaimsExchangeId** to a friendly name, such as `BindIDExchange`.
254+
255+
2. In the next orchestration step, add a **ClaimsExchange** element. Set the **Id** to the value of the target claims exchange ID to link the BindID button to `BindID-SignIn` action. Update the value of **TechnicalProfileReferenceId** to the ID of the technical profile you created earlier.
256+
257+
The following XML demonstrates orchestration steps of a user journey with the identity provider:
258+
259+
260+
```xml
261+
<OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
262+
<ClaimsProviderSelections>
263+
...
264+
<ClaimsProviderSelection TargetClaimsExchangeId="BindIDExchange" />
265+
</ClaimsProviderSelections>
266+
...
267+
</OrchestrationStep>
268+
269+
<OrchestrationStep Order="2" Type="ClaimsExchange">
270+
...
271+
<ClaimsExchanges>
272+
<ClaimsExchange Id="BindIDExchange" TechnicalProfileReferenceId="BindID-OpenIdConnect" />
273+
</ClaimsExchanges>
274+
</OrchestrationStep>
275+
```
276+
277+
### Step 6 - Configure the relying party policy
278+
279+
The relying party policy, for example [SignUpSignIn.xml](https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/blob/master/SocialAccounts/SignUpOrSignin.xml), specifies the user journey which Azure AD B2C will execute. You can also control what claims are passed to your application by adjusting the **OutputClaims** element of the **PolicyProfile** TechnicalProfile element. In this sample, the application will receive the user attributes such as display name, given name, surname, email, objectId, identity provider, and tenantId.
280+
281+
```xml
282+
<RelyingParty>
283+
<DefaultUserJourney ReferenceId="SignUpOrSignInWithBindID" />
284+
<TechnicalProfile Id="BindID-OpenIdConnect">
285+
<DisplayName>PolicyProfile</DisplayName>
286+
<Protocol Name="OpenIdConnect" />
287+
<OutputClaims>
288+
<OutputClaim ClaimTypeReferenceId="displayName" />
289+
<OutputClaim ClaimTypeReferenceId="givenName" />
290+
<OutputClaim ClaimTypeReferenceId="surname" />
291+
<OutputClaim ClaimTypeReferenceId="email" />
292+
<OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/>
293+
<OutputClaim ClaimTypeReferenceId="identityProvider" />
294+
<OutputClaim ClaimTypeReferenceId="tenantId" AlwaysUseDefaultValue="true" DefaultValue="{Policy:TenantObjectId}" />
295+
</OutputClaims>
296+
<SubjectNamingInfo ClaimType="sub" />
297+
</TechnicalProfile>
298+
</RelyingParty>
299+
```
300+
301+
### Step 7 - Upload the custom policy
302+
303+
1. Sign in to the [Azure portal](https://portal.azure.com/#home).
304+
305+
2. Make sure you're using the directory that contains your Azure AD B2C tenant. Select the **Directories + subscriptions** icon in the portal toolbar.
306+
307+
3. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**.
308+
309+
4. In the [Azure portal](https://portal.azure.com/#home), search for and select **Azure AD B2C**.
310+
311+
5. Under Policies, select **Identity Experience Framework**.
312+
313+
6. Select **Upload Custom Policy**, and then upload the two policy files that you changed, in the following order: the extension policy, for example `TrustFrameworkExtensions.xml`, then the relying party policy, such as `SignUpSignIn.xml`.
314+
315+
316+
### Step 8 - Test your custom policy
317+
318+
1. Open the Azure AD B2C tenant and under Policies select **Identity Experience Framework**.
319+
320+
2. Click on your previously created **CustomSignUpSignIn** and select the settings:
321+
322+
a. **Application**: select the registered app (sample is JWT)
323+
324+
b. **Reply URL**: select the **redirect URL** that should show `https://jwt.ms`.
325+
326+
c. Select **Run now**.
327+
328+
If the sign-in process is successful, your browser is redirected to `https://jwt.ms`, which displays the contents of the token returned by Azure AD B2C.
329+
330+
::: zone-end
331+
332+
## Next steps
333+
334+
For additional information, review the following articles:
335+
336+
- [Custom policies in Azure AD B2C](custom-policy-overview.md)
337+
338+
- [Get started with custom policies in Azure AD B2C](tutorial-create-user-flows.md?pivots=b2c-custom-policy)
339+
340+
- [Sample custom policies for BindID and Azure AD B2C integration](https://github.com/TransmitSecurity/azure-ad-b2c-bindid-integration)
341+
342+

‎articles/active-directory-b2c/partner-gallery.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ Microsoft partners with the following ISVs for MFA and Passwordless authenticati
4141

4242
| ISV partner | Description and integration walkthroughs |
4343
|:-------------------------|:--------------|
44+
|![Screenshot of a bindid logo](./media/partner-gallery/bindid-logo.png) | [Transmit Security's](./partner-bindid.md) solution BindID is a passwordless authentication service that uses strong FIDO2 biometric authentication for a reliable omni-channel authentication experience, which ensures a smooth login experience for customers across every device and channel eliminating fraud, phishing, and credential reuse. |
4445
| ![Screenshot of a bloksec logo](./media/partner-gallery/bloksec-logo.png) | [BlokSec](./partner-bloksec.md) is a passwordless authentication and tokenless MFA solution, which provides real-time consent-based services and protects customers against identity-centric cyber-attacks such as password stuffing, phishing, and man-in-the-middle attacks. |
4546
| ![Screenshot of a haventec logo](./media/partner-gallery/haventec-logo.png) | [Haventec](./partner-haventec.md) is a passwordless authentication provider, which provides decentralized identity platform that eliminates passwords, shared secrets, and friction. |
4647
| ![Screenshot of a hypr logo](./media/partner-gallery/hypr-logo.png) | [Hypr](./partner-hypr.md) is a passwordless authentication provider, which replaces passwords with public key encryptions eliminating fraud, phishing, and credential reuse. |

0 commit comments

Comments
 (0)