Skip to content

Commit 16ce91f

Browse files
bernawybernawy
authored
Update LinkedIn instructions
Update instructions because they don't work anymore. On August 1, 2023, LinkedIn discontinued OAuth2 as the IdP protocol for new configurations
1 parent 5c0cef5 commit 16ce91f

File tree

1 file changed

+38
-77
lines changed

1 file changed

+38
-77
lines changed

‎articles/active-directory-b2c/identity-provider-linkedin.md

Lines changed: 38 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -31,15 +31,15 @@ zone_pivot_groups: b2c-policy-type
3131

3232
## Create a LinkedIn application
3333

34-
To enable sign-in for users with a LinkedIn account in Azure Active Directory B2C (Azure AD B2C), you need to create an application in [LinkedIn Developers website](https://developer.linkedin.com/). For more information, see [Authorization Code Flow](/linkedin/shared/authentication/authorization-code-flow). If you don't already have a LinkedIn account, you can sign up at [https://www.linkedin.com/](https://www.linkedin.com/).
34+
To enable sign-in for users with a LinkedIn account in Azure Active Directory B2C (Azure AD B2C), you need to create an application in [LinkedIn Developers website](https://developer.linkedin.com/). If you don't already have a LinkedIn account, you can sign up at [https://www.linkedin.com/](https://www.linkedin.com/).
3535

3636
1. Sign in to the [LinkedIn Developers website](https://developer.linkedin.com/) with your LinkedIn account credentials.
3737
1. Select **My Apps**, and then click **Create app**.
3838
1. Enter **App name**, **LinkedIn Page**, **Privacy policy URL**, and **App logo**.
3939
1. Agree to the LinkedIn **API Terms of Use** and click **Create app**.
4040
1. Select the **Auth** tab. Under **Authentication Keys**, copy the values for **Client ID** and **Client Secret**. You'll need both of them to configure LinkedIn as an identity provider in your tenant. **Client Secret** is an important security credential.
4141
1. Select the edit pencil next to **Authorized redirect URLs for your app**, and then select **Add redirect URL**. Enter `https://your-tenant-name.b2clogin.com/your-tenant-name.onmicrosoft.com/oauth2/authresp`. If you use a [custom domain](custom-domain.md), enter `https://your-domain-name/your-tenant-name.onmicrosoft.com/oauth2/authresp`. Replace `your-tenant-name` with the name of your tenant, and `your-domain-name` with your custom domain. You need to use all lowercase letters when entering your tenant name even if the tenant is defined with uppercase letters in Azure AD B2C. Select **Update**.
42-
1. By default, your LinkedIn app isn't approved for scopes related to sign in. To request a review, select the **Products** tab, and then select **Sign In with LinkedIn**. When the review is complete, the required scopes will be added to your application.
42+
1. By default, your LinkedIn app isn't approved for scopes related to sign in. To request a review, select the **Products** tab, and then select **Sign In with LinkedIn using OpenID Connect**. When the review is complete, the required scopes will be added to your application.
4343
> [!NOTE]
4444
> You can view the scopes that are currently allowed for your app on the **Auth** tab in the **OAuth 2.0 scopes** section.
4545
@@ -49,11 +49,20 @@ To enable sign-in for users with a LinkedIn account in Azure Active Directory B2
4949

5050
1. Sign in to the [Azure portal](https://portal.azure.com/) as the global administrator of your Azure AD B2C tenant.
5151
1. If you have access to multiple tenants, select the **Settings** icon in the top menu to switch to your Azure AD B2C tenant from the **Directories + subscriptions** menu.
52+
1. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**.
5253
1. Choose **All services** in the top-left corner of the Azure portal, search for and select **Azure AD B2C**.
53-
1. Select **Identity providers**, then select **LinkedIn**.
54-
1. Enter a **Name**. For example, *LinkedIn*.
54+
1. Select **Identity providers**, then select **New OpenID Connect provider**.
55+
1. Enter a **Name**. For example, *LinkedIn-OIDC*.
56+
1. For the **Metadata URL**, enter **https://www.linkedin.com/oauth/.well-known/openid-configuration**.
5557
1. For the **Client ID**, enter the Client ID of the LinkedIn application that you created earlier.
5658
1. For the **Client secret**, enter the Client Secret that you recorded.
59+
1. For the **Scope**, enter **openid profile email**.
60+
1. For the **Response type**, enter **code**.
61+
1. For the **User ID**, enter **email**.
62+
1. For the **Display name**, enter **name**.
63+
1. For the **Given name**, enter **given_name**.
64+
1. For the **Surname**, enter **family_name**.
65+
1. For the **Email**, enter **email**.
5766
1. Select **Save**.
5867

5968
## Add LinkedIn identity provider to a user flow
@@ -62,12 +71,12 @@ At this point, the LinkedIn identity provider has been set up, but it's not yet
6271

6372
1. In your Azure AD B2C tenant, select **User flows**.
6473
1. Click the user flow that you want to add the LinkedIn identity provider.
65-
1. Under the **Social identity providers**, select **LinkedIn**.
74+
1. Under the **Custom identity providers**, select **LinkedIn-OIDC**.
6675
1. Select **Save**.
6776
1. To test your policy, select **Run user flow**.
6877
1. For **Application**, select the web application named *testapp1* that you previously registered. The **Reply URL** should show `https://jwt.ms`.
6978
1. Select the **Run user flow** button.
70-
1. From the sign-up or sign-in page, select **LinkedIn** to sign in with LinkedIn account.
79+
1. From the sign-up or sign-in page, select **LinkedIn-OIDC** to sign in with LinkedIn account.
7180

7281
If the sign-in process is successful, your browser is redirected to `https://jwt.ms`, which displays the contents of the token returned by Azure AD B2C.
7382

@@ -81,6 +90,7 @@ You need to store the client secret that you previously recorded in your Azure A
8190

8291
1. Sign in to the [Azure portal](https://portal.azure.com/).
8392
1. If you have access to multiple tenants, select the **Settings** icon in the top menu to switch to your Azure AD B2C tenant from the **Directories + subscriptions** menu.
93+
1. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**.
8494
1. Choose **All services** in the top-left corner of the Azure portal, and then search for and select **Azure AD B2C**.
8595
1. On the Overview page, select **Identity Experience Framework**.
8696
1. Select **Policy keys** and then select **Add**.
@@ -103,94 +113,45 @@ Define a LinkedIn account as a claims provider by adding it to the **ClaimsProvi
103113
```xml
104114
<ClaimsProvider>
105115
<Domain>linkedin.com</Domain>
106-
<DisplayName>LinkedIn</DisplayName>
116+
<DisplayName>LinkedIn-OIDC</DisplayName>
107117
<TechnicalProfiles>
108-
<TechnicalProfile Id="LinkedIn-OAuth2">
118+
<TechnicalProfile Id="LinkedIn-OIDC">
109119
<DisplayName>LinkedIn</DisplayName>
110-
<Protocol Name="OAuth2" />
120+
<Protocol Name="OpenIdConnect" />
111121
<Metadata>
112-
<Item Key="ProviderName">linkedin</Item>
113-
<Item Key="authorization_endpoint">https://www.linkedin.com/oauth/v2/authorization</Item>
114-
<Item Key="AccessTokenEndpoint">https://www.linkedin.com/oauth/v2/accessToken</Item>
115-
<Item Key="ClaimsEndpoint">https://api.linkedin.com/v2/me</Item>
116-
<Item Key="scope">r_emailaddress r_liteprofile</Item>
117-
<Item Key="HttpBinding">POST</Item>
118-
<Item Key="external_user_identity_claim_id">id</Item>
119-
<Item Key="BearerTokenTransmissionMethod">AuthorizationHeader</Item>
120-
<Item Key="ResolveJsonPathsInJsonTokens">true</Item>
121-
<Item Key="UsePolicyInRedirectUri">false</Item>
122-
<Item Key="client_id">Your LinkedIn application client ID</Item>
122+
<Item Key="METADATA">https://www.linkedin.com/oauth/.well-known/openid-configuration</Item>
123+
<Item Key="scope">openid profile email</Item>
124+
<Item Key="HttpBinding">POST</Item>
125+
<Item Key="response_types">code</Item>
126+
<Item Key="UsePolicyInRedirectUri">false</Item>
127+
<Item Key="client_id">Your LinkedIn application client ID</Item>
123128
</Metadata>
124129
<CryptographicKeys>
125-
<Key Id="client_secret" StorageReferenceId="B2C_1A_LinkedInSecret" />
130+
<Key Id="client_secret" StorageReferenceId="B2C_1A_LinkedInSecret" />
126131
</CryptographicKeys>
127132
<InputClaims />
128133
<OutputClaims>
129-
<OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="id" />
130-
<OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="firstName.localized" />
131-
<OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="lastName.localized" />
132-
<OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="linkedin.com" AlwaysUseDefaultValue="true" />
133-
<OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true" />
134+
<OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="email" />
135+
<OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
136+
<OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="family_name" />
137+
<OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="linkedin.com" AlwaysUseDefaultValue="true" />
138+
<OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true" />
134139
</OutputClaims>
135140
<OutputClaimsTransformations>
136-
<OutputClaimsTransformation ReferenceId="ExtractGivenNameFromLinkedInResponse" />
137-
<OutputClaimsTransformation ReferenceId="ExtractSurNameFromLinkedInResponse" />
138-
<OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
139-
<OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
140-
<OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
141-
<OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
141+
<OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
142+
<OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
143+
<OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
144+
<OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
142145
</OutputClaimsTransformations>
143146
<UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
144-
</TechnicalProfile>
147+
</TechnicalProfile>
145148
</TechnicalProfiles>
146149
</ClaimsProvider>
147150
```
148151

149152
1. Replace the value of **client_id** with the client ID of the LinkedIn application that you previously recorded.
150153
1. Save the file.
151154

152-
### Add the claims transformations
153-
154-
The LinkedIn technical profile requires the **ExtractGivenNameFromLinkedInResponse** and **ExtractSurNameFromLinkedInResponse** claims transformations to be added to the list of ClaimsTransformations. If you don't have a **ClaimsTransformations** element defined in your file, add the parent XML elements as shown below. The claims transformations also need a new claim type defined named **nullStringClaim**.
155-
156-
Add the **BuildingBlocks** element near the top of the *TrustFrameworkExtensions.xml* file. See *TrustFrameworkBase.xml* for an example.
157-
158-
```xml
159-
<BuildingBlocks>
160-
<ClaimsSchema>
161-
<!-- Claim type needed for LinkedIn claims transformations -->
162-
<ClaimType Id="nullStringClaim">
163-
<DisplayName>nullClaim</DisplayName>
164-
<DataType>string</DataType>
165-
<AdminHelpText>A policy claim to store output values from ClaimsTransformations that aren't useful. This claim should not be used in TechnicalProfiles.</AdminHelpText>
166-
<UserHelpText>A policy claim to store output values from ClaimsTransformations that aren't useful. This claim should not be used in TechnicalProfiles.</UserHelpText>
167-
</ClaimType>
168-
</ClaimsSchema>
169-
170-
<ClaimsTransformations>
171-
<!-- Claim transformations needed for LinkedIn technical profile -->
172-
<ClaimsTransformation Id="ExtractGivenNameFromLinkedInResponse" TransformationMethod="GetSingleItemFromJson">
173-
<InputClaims>
174-
<InputClaim ClaimTypeReferenceId="givenName" TransformationClaimType="inputJson" />
175-
</InputClaims>
176-
<OutputClaims>
177-
<OutputClaim ClaimTypeReferenceId="nullStringClaim" TransformationClaimType="key" />
178-
<OutputClaim ClaimTypeReferenceId="givenName" TransformationClaimType="value" />
179-
</OutputClaims>
180-
</ClaimsTransformation>
181-
<ClaimsTransformation Id="ExtractSurNameFromLinkedInResponse" TransformationMethod="GetSingleItemFromJson">
182-
<InputClaims>
183-
<InputClaim ClaimTypeReferenceId="surname" TransformationClaimType="inputJson" />
184-
</InputClaims>
185-
<OutputClaims>
186-
<OutputClaim ClaimTypeReferenceId="nullStringClaim" TransformationClaimType="key" />
187-
<OutputClaim ClaimTypeReferenceId="surname" TransformationClaimType="value" />
188-
</OutputClaims>
189-
</ClaimsTransformation>
190-
</ClaimsTransformations>
191-
</BuildingBlocks>
192-
```
193-
194155
[!INCLUDE [active-directory-b2c-add-identity-provider-to-user-journey](../../includes/active-directory-b2c-add-identity-provider-to-user-journey.md)]
195156

196157

@@ -206,7 +167,7 @@ Add the **BuildingBlocks** element near the top of the *TrustFrameworkExtensions
206167
<OrchestrationStep Order="2" Type="ClaimsExchange">
207168
...
208169
<ClaimsExchanges>
209-
<ClaimsExchange Id="LinkedInExchange" TechnicalProfileReferenceId="LinkedIn-OAuth2" />
170+
<ClaimsExchange Id="LinkedInExchange" TechnicalProfileReferenceId="LinkedIn-OIDC" />
210171
</ClaimsExchanges>
211172
</OrchestrationStep>
212173
```
@@ -218,7 +179,7 @@ Add the **BuildingBlocks** element near the top of the *TrustFrameworkExtensions
218179
1. Select your relying party policy, for example `B2C_1A_signup_signin`.
219180
1. For **Application**, select a web application that you [previously registered](tutorial-register-applications.md). The **Reply URL** should show `https://jwt.ms`.
220181
1. Select the **Run now** button.
221-
1. From the sign-up or sign-in page, select **LinkedIn** to sign in with LinkedIn account.
182+
1. From the sign-up or sign-in page, select **LinkedIn-OIDC** to sign in with LinkedIn account.
222183

223184
If the sign-in process is successful, your browser is redirected to `https://jwt.ms`, which displays the contents of the token returned by Azure AD B2C.
224185

0 commit comments

Comments
 (0)