Skip to content

Commit 1eb2994

Browse files
markingmynamemarkingmyname
committed
Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into aditya
2 parents 5272012 + 3519cf2 commit 1eb2994

File tree

211 files changed

+4410
-1901
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

211 files changed

+4410
-1901
lines changed

‎.openpublishing.redirection.json

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4000,11 +4000,6 @@
40004000
"redirect_url":"/azure/reliability/reliability-containers",
40014001
"redirect_document_id":false
40024002
},
4003-
{
4004-
"source_path_from_root":"/articles/service-connector/quickstart-cli-aks-connection.md",
4005-
"redirect_url":"/azure/service-connector/quickstart-portal-aks-connection",
4006-
"redirect_document_id":false
4007-
},
40084003
{
40094004
"source_path_from_root":"/articles/aks/generation-2-vm-windows.md",
40104005
"redirect_url":"/azure/aks/generation-2-vm",

‎articles/active-directory-b2c/identity-provider-linkedin.md

Lines changed: 40 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -31,15 +31,15 @@ zone_pivot_groups: b2c-policy-type
3131

3232
## Create a LinkedIn application
3333

34-
To enable sign-in for users with a LinkedIn account in Azure Active Directory B2C (Azure AD B2C), you need to create an application in [LinkedIn Developers website](https://developer.linkedin.com/). For more information, see [Authorization Code Flow](/linkedin/shared/authentication/authorization-code-flow). If you don't already have a LinkedIn account, you can sign up at [https://www.linkedin.com/](https://www.linkedin.com/).
34+
To enable sign-in for users with a LinkedIn account in Azure Active Directory B2C (Azure AD B2C), you need to create an application in [LinkedIn Developers website](https://developer.linkedin.com/). If you don't already have a LinkedIn account, you can sign up at [https://www.linkedin.com/](https://www.linkedin.com/).
3535

3636
1. Sign in to the [LinkedIn Developers website](https://developer.linkedin.com/) with your LinkedIn account credentials.
3737
1. Select **My Apps**, and then click **Create app**.
3838
1. Enter **App name**, **LinkedIn Page**, **Privacy policy URL**, and **App logo**.
3939
1. Agree to the LinkedIn **API Terms of Use** and click **Create app**.
4040
1. Select the **Auth** tab. Under **Authentication Keys**, copy the values for **Client ID** and **Client Secret**. You'll need both of them to configure LinkedIn as an identity provider in your tenant. **Client Secret** is an important security credential.
4141
1. Select the edit pencil next to **Authorized redirect URLs for your app**, and then select **Add redirect URL**. Enter `https://your-tenant-name.b2clogin.com/your-tenant-name.onmicrosoft.com/oauth2/authresp`. If you use a [custom domain](custom-domain.md), enter `https://your-domain-name/your-tenant-name.onmicrosoft.com/oauth2/authresp`. Replace `your-tenant-name` with the name of your tenant, and `your-domain-name` with your custom domain. You need to use all lowercase letters when entering your tenant name even if the tenant is defined with uppercase letters in Azure AD B2C. Select **Update**.
42-
1. By default, your LinkedIn app isn't approved for scopes related to sign in. To request a review, select the **Products** tab, and then select **Sign In with LinkedIn**. When the review is complete, the required scopes will be added to your application.
42+
1. By default, your LinkedIn app isn't approved for scopes related to sign in. To request a review, select the **Products** tab, and then select **Sign In with LinkedIn using OpenID Connect**. When the review is complete, the required scopes will be added to your application.
4343
> [!NOTE]
4444
> You can view the scopes that are currently allowed for your app on the **Auth** tab in the **OAuth 2.0 scopes** section.
4545
@@ -49,11 +49,20 @@ To enable sign-in for users with a LinkedIn account in Azure Active Directory B2
4949

5050
1. Sign in to the [Azure portal](https://portal.azure.com/) as the global administrator of your Azure AD B2C tenant.
5151
1. If you have access to multiple tenants, select the **Settings** icon in the top menu to switch to your Azure AD B2C tenant from the **Directories + subscriptions** menu.
52+
1. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**.
5253
1. Choose **All services** in the top-left corner of the Azure portal, search for and select **Azure AD B2C**.
53-
1. Select **Identity providers**, then select **LinkedIn**.
54-
1. Enter a **Name**. For example, *LinkedIn*.
54+
1. Select **Identity providers**, then select **New OpenID Connect provider**.
55+
1. Enter a **Name**. For example, *LinkedIn-OIDC*.
56+
1. For the **Metadata URL**, enter **https://www.linkedin.com/oauth/.well-known/openid-configuration**.
5557
1. For the **Client ID**, enter the Client ID of the LinkedIn application that you created earlier.
5658
1. For the **Client secret**, enter the Client Secret that you recorded.
59+
1. For the **Scope**, enter **openid profile email**.
60+
1. For the **Response type**, enter **code**.
61+
1. For the **User ID**, enter **email**.
62+
1. For the **Display name**, enter **name**.
63+
1. For the **Given name**, enter **given_name**.
64+
1. For the **Surname**, enter **family_name**.
65+
1. For the **Email**, enter **email**.
5766
1. Select **Save**.
5867

5968
## Add LinkedIn identity provider to a user flow
@@ -62,12 +71,12 @@ At this point, the LinkedIn identity provider has been set up, but it's not yet
6271

6372
1. In your Azure AD B2C tenant, select **User flows**.
6473
1. Click the user flow that you want to add the LinkedIn identity provider.
65-
1. Under the **Social identity providers**, select **LinkedIn**.
74+
1. Under the **Custom identity providers**, select **LinkedIn-OIDC**.
6675
1. Select **Save**.
6776
1. To test your policy, select **Run user flow**.
6877
1. For **Application**, select the web application named *testapp1* that you previously registered. The **Reply URL** should show `https://jwt.ms`.
6978
1. Select the **Run user flow** button.
70-
1. From the sign-up or sign-in page, select **LinkedIn** to sign in with LinkedIn account.
79+
1. From the sign-up or sign-in page, select **LinkedIn-OIDC** to sign in with LinkedIn account.
7180

7281
If the sign-in process is successful, your browser is redirected to `https://jwt.ms`, which displays the contents of the token returned by Azure AD B2C.
7382

@@ -81,6 +90,7 @@ You need to store the client secret that you previously recorded in your Azure A
8190

8291
1. Sign in to the [Azure portal](https://portal.azure.com/).
8392
1. If you have access to multiple tenants, select the **Settings** icon in the top menu to switch to your Azure AD B2C tenant from the **Directories + subscriptions** menu.
93+
1. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**.
8494
1. Choose **All services** in the top-left corner of the Azure portal, and then search for and select **Azure AD B2C**.
8595
1. On the Overview page, select **Identity Experience Framework**.
8696
1. Select **Policy keys** and then select **Add**.
@@ -92,7 +102,7 @@ You need to store the client secret that you previously recorded in your Azure A
92102

93103
## Configure LinkedIn as an identity provider
94104

95-
To enable users to sign in using an LinkedIn account, you need to define the account as a claims provider that Azure AD B2C can communicate with through an endpoint. The endpoint provides a set of claims that are used by Azure AD B2C to verify that a specific user has authenticated.
105+
To enable users to sign in using a LinkedIn account, you need to define the account as a claims provider that Azure AD B2C can communicate with through an endpoint. The endpoint provides a set of claims that are used by Azure AD B2C to verify that a specific user has authenticated.
96106

97107
Define a LinkedIn account as a claims provider by adding it to the **ClaimsProviders** element in the extension file of your policy.
98108

@@ -103,94 +113,45 @@ Define a LinkedIn account as a claims provider by adding it to the **ClaimsProvi
103113
```xml
104114
<ClaimsProvider>
105115
<Domain>linkedin.com</Domain>
106-
<DisplayName>LinkedIn</DisplayName>
116+
<DisplayName>LinkedIn-OIDC</DisplayName>
107117
<TechnicalProfiles>
108-
<TechnicalProfile Id="LinkedIn-OAuth2">
118+
<TechnicalProfile Id="LinkedIn-OIDC">
109119
<DisplayName>LinkedIn</DisplayName>
110-
<Protocol Name="OAuth2" />
120+
<Protocol Name="OpenIdConnect" />
111121
<Metadata>
112-
<Item Key="ProviderName">linkedin</Item>
113-
<Item Key="authorization_endpoint">https://www.linkedin.com/oauth/v2/authorization</Item>
114-
<Item Key="AccessTokenEndpoint">https://www.linkedin.com/oauth/v2/accessToken</Item>
115-
<Item Key="ClaimsEndpoint">https://api.linkedin.com/v2/me</Item>
116-
<Item Key="scope">r_emailaddress r_liteprofile</Item>
117-
<Item Key="HttpBinding">POST</Item>
118-
<Item Key="external_user_identity_claim_id">id</Item>
119-
<Item Key="BearerTokenTransmissionMethod">AuthorizationHeader</Item>
120-
<Item Key="ResolveJsonPathsInJsonTokens">true</Item>
121-
<Item Key="UsePolicyInRedirectUri">false</Item>
122-
<Item Key="client_id">Your LinkedIn application client ID</Item>
122+
<Item Key="METADATA">https://www.linkedin.com/oauth/.well-known/openid-configuration</Item>
123+
<Item Key="scope">openid profile email</Item>
124+
<Item Key="HttpBinding">POST</Item>
125+
<Item Key="response_types">code</Item>
126+
<Item Key="UsePolicyInRedirectUri">false</Item>
127+
<Item Key="client_id">Your LinkedIn application client ID</Item>
123128
</Metadata>
124129
<CryptographicKeys>
125-
<Key Id="client_secret" StorageReferenceId="B2C_1A_LinkedInSecret" />
130+
<Key Id="client_secret" StorageReferenceId="B2C_1A_LinkedInSecret" />
126131
</CryptographicKeys>
127132
<InputClaims />
128133
<OutputClaims>
129-
<OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="id" />
130-
<OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="firstName.localized" />
131-
<OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="lastName.localized" />
132-
<OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="linkedin.com" AlwaysUseDefaultValue="true" />
133-
<OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true" />
134+
<OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="email" />
135+
<OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
136+
<OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="family_name" />
137+
<OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="linkedin.com" AlwaysUseDefaultValue="true" />
138+
<OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true" />
134139
</OutputClaims>
135140
<OutputClaimsTransformations>
136-
<OutputClaimsTransformation ReferenceId="ExtractGivenNameFromLinkedInResponse" />
137-
<OutputClaimsTransformation ReferenceId="ExtractSurNameFromLinkedInResponse" />
138-
<OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
139-
<OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
140-
<OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
141-
<OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
141+
<OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
142+
<OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
143+
<OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
144+
<OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
142145
</OutputClaimsTransformations>
143146
<UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
144-
</TechnicalProfile>
147+
</TechnicalProfile>
145148
</TechnicalProfiles>
146149
</ClaimsProvider>
147150
```
148151

149152
1. Replace the value of **client_id** with the client ID of the LinkedIn application that you previously recorded.
150153
1. Save the file.
151154

152-
### Add the claims transformations
153-
154-
The LinkedIn technical profile requires the **ExtractGivenNameFromLinkedInResponse** and **ExtractSurNameFromLinkedInResponse** claims transformations to be added to the list of ClaimsTransformations. If you don't have a **ClaimsTransformations** element defined in your file, add the parent XML elements as shown below. The claims transformations also need a new claim type defined named **nullStringClaim**.
155-
156-
Add the **BuildingBlocks** element near the top of the *TrustFrameworkExtensions.xml* file. See *TrustFrameworkBase.xml* for an example.
157-
158-
```xml
159-
<BuildingBlocks>
160-
<ClaimsSchema>
161-
<!-- Claim type needed for LinkedIn claims transformations -->
162-
<ClaimType Id="nullStringClaim">
163-
<DisplayName>nullClaim</DisplayName>
164-
<DataType>string</DataType>
165-
<AdminHelpText>A policy claim to store output values from ClaimsTransformations that aren't useful. This claim should not be used in TechnicalProfiles.</AdminHelpText>
166-
<UserHelpText>A policy claim to store output values from ClaimsTransformations that aren't useful. This claim should not be used in TechnicalProfiles.</UserHelpText>
167-
</ClaimType>
168-
</ClaimsSchema>
169-
170-
<ClaimsTransformations>
171-
<!-- Claim transformations needed for LinkedIn technical profile -->
172-
<ClaimsTransformation Id="ExtractGivenNameFromLinkedInResponse" TransformationMethod="GetSingleItemFromJson">
173-
<InputClaims>
174-
<InputClaim ClaimTypeReferenceId="givenName" TransformationClaimType="inputJson" />
175-
</InputClaims>
176-
<OutputClaims>
177-
<OutputClaim ClaimTypeReferenceId="nullStringClaim" TransformationClaimType="key" />
178-
<OutputClaim ClaimTypeReferenceId="givenName" TransformationClaimType="value" />
179-
</OutputClaims>
180-
</ClaimsTransformation>
181-
<ClaimsTransformation Id="ExtractSurNameFromLinkedInResponse" TransformationMethod="GetSingleItemFromJson">
182-
<InputClaims>
183-
<InputClaim ClaimTypeReferenceId="surname" TransformationClaimType="inputJson" />
184-
</InputClaims>
185-
<OutputClaims>
186-
<OutputClaim ClaimTypeReferenceId="nullStringClaim" TransformationClaimType="key" />
187-
<OutputClaim ClaimTypeReferenceId="surname" TransformationClaimType="value" />
188-
</OutputClaims>
189-
</ClaimsTransformation>
190-
</ClaimsTransformations>
191-
</BuildingBlocks>
192-
```
193-
194155
[!INCLUDE [active-directory-b2c-add-identity-provider-to-user-journey](../../includes/active-directory-b2c-add-identity-provider-to-user-journey.md)]
195156

196157

@@ -206,7 +167,7 @@ Add the **BuildingBlocks** element near the top of the *TrustFrameworkExtensions
206167
<OrchestrationStep Order="2" Type="ClaimsExchange">
207168
...
208169
<ClaimsExchanges>
209-
<ClaimsExchange Id="LinkedInExchange" TechnicalProfileReferenceId="LinkedIn-OAuth2" />
170+
<ClaimsExchange Id="LinkedInExchange" TechnicalProfileReferenceId="LinkedIn-OIDC" />
210171
</ClaimsExchanges>
211172
</OrchestrationStep>
212173
```
@@ -218,7 +179,7 @@ Add the **BuildingBlocks** element near the top of the *TrustFrameworkExtensions
218179
1. Select your relying party policy, for example `B2C_1A_signup_signin`.
219180
1. For **Application**, select a web application that you [previously registered](tutorial-register-applications.md). The **Reply URL** should show `https://jwt.ms`.
220181
1. Select the **Run now** button.
221-
1. From the sign-up or sign-in page, select **LinkedIn** to sign in with LinkedIn account.
182+
1. From the sign-up or sign-in page, select **LinkedIn-OIDC** to sign in with LinkedIn account.
222183

223184
If the sign-in process is successful, your browser is redirected to `https://jwt.ms`, which displays the contents of the token returned by Azure AD B2C.
224185

@@ -375,7 +336,7 @@ As part of the LinkedIn migration from v1.0 to v2.0, an additional call to anoth
375336
</OrchestrationStep>
376337
```
377338

378-
Obtaining the email address from LinkedIn during sign-up is optional. If you choose not to obtain the email from LinkedIn but require one during sign up, the user is required to manually enter the email address and validate it.
339+
Obtaining the email address from LinkedIn during sign-up is optional. If you choose not to obtain the email from LinkedIn but require one during sign-up, the user is required to manually enter the email address and validate it.
379340

380341
For a full sample of a policy that uses the LinkedIn identity provider, see the [Custom Policy Starter Pack](https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/tree/master/scenarios/linkedin-identity-provider).
381342

‎articles/active-directory-b2c/partner-saviynt.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ ms.subservice: B2C
1818

1919
Learn to integrate Azure Active Directory B2C (Azure AD B2C) with the Saviynt Security Manager platform, which has visibility, security, and governance. Saviynt incorporates application risk and governance, infrastructure management, privileged account management, and customer risk analysis.
2020

21-
Learn more: [Saviynt for Azure AD B2C](https://saviynt.com/integrations/old-version-azure-ad/for-b2c/)
21+
Learn more: [Saviynt for Azure AD B2C](https://saviynt.com/fr/integrations/entra-id/for-b2c)
2222

2323
Use the following instructions to set up access control delegated administration for Azure AD B2C users. Saviynt determines if a user is authorized to manage Azure AD B2C users with:
2424

@@ -46,7 +46,7 @@ The Saviynt integration includes the following components:
4646
* **Azure AD B2C** – identity as a service for custom control of customer sign-up, sign-in, and profile management
4747
* See, [Azure AD B2C, Get started](https://azure.microsoft.com/services/active-directory/external-identities/b2c/)
4848
* **Saviynt for Azure AD B2C** – identity governance for delegated administration of user life-cycle management and access governance
49-
* See, [Saviynt for Azure AD B2C](https://saviynt.com/integrations/old-version-azure-ad/for-b2c/)
49+
* See, [Saviynt for Azure AD B2C](https://saviynt.com/fr/integrations/entra-id/for-b2c)
5050
* **Microsoft Graph API** – interface for Saviynt to manage Azure AD B2C users and their access
5151
* See, [Use the Microsoft Graph API](/graph/use-the-api)
5252

0 commit comments

Comments
 (0)