You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/custom-policy-developer-notes.md
+64-47Lines changed: 64 additions & 47 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ manager: celestedg
9
9
ms.service: active-directory
10
10
ms.workload: identity
11
11
ms.topic: conceptual
12
-
ms.date: 02/12/2020
12
+
ms.date: 03/30/2020
13
13
ms.author: mimart
14
14
ms.subservice: B2C
15
15
---
@@ -55,85 +55,102 @@ Developers consuming the custom policy feature set should adhere to the followin
55
55
56
56
Custom policy/Identity Experience Framework capabilities are under constant and rapid development. The following table is an index of features and component availability.
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/saml-technical-profile.md
+27-4Lines changed: 27 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ manager: celestedg
9
9
ms.service: active-directory
10
10
ms.workload: identity
11
11
ms.topic: reference
12
-
ms.date: 02/13/2020
12
+
ms.date: 03/30/2020
13
13
ms.author: mimart
14
14
ms.subservice: B2C
15
15
---
@@ -86,11 +86,32 @@ The **Name** attribute of the Protocol element needs to be set to `SAML2`.
86
86
87
87
The **OutputClaims** element contains a list of claims returned by the SAML identity provider under the `AttributeStatement` section. You may need to map the name of the claim defined in your policy to the name defined in the identity provider. You can also include claims that aren't returned by the identity provider as long as you set the `DefaultValue` attribute.
88
88
89
-
To read the SAML assertion **NamedId** in **Subject** as a normalized claim, set the claim **PartnerClaimType** to `assertionSubjectName`. Make sure the **NameId** is the first value in assertion XML. When you define more than one assertion, Azure AD B2C picks the subject value from the last assertion.
89
+
### Subject name output claim
90
+
91
+
To read the SAML assertion **NameId** in the **Subject** as a normalized claim, set the claim **PartnerClaimType** to value of the `SPNameQualifier` attribute. If the `SPNameQualifier`attribute is not presented, set the claim **PartnerClaimType** to value of the `NameQualifier` attribute.
90
92
91
-
The **OutputClaimsTransformations** element may contain a collection of **OutputClaimsTransformation** elements that are used to modify the output claims or generate new ones.
92
93
93
-
The following example shows the claims returned by the Facebook identity provider:
If both `SPNameQualifier` or `NameQualifier` attributes are not presented in the SAML assertion, set the claim **PartnerClaimType** to `assertionSubjectName`. Make sure the **NameId** is the first value in assertion XML. When you define more than one assertion, Azure AD B2C picks the subject value from the last assertion.
113
+
114
+
The following example shows the claims returned by a SAML identity provider:
94
115
95
116
- The **issuerUserId** claim is mapped to the **assertionSubjectName** claim.
96
117
- The **first_name** claim is mapped to the **givenName** claim.
@@ -115,6 +136,8 @@ The technical profile also returns claims that aren't returned by the identity p
115
136
</OutputClaims>
116
137
```
117
138
139
+
The **OutputClaimsTransformations** element may contain a collection of **OutputClaimsTransformation** elements that are used to modify the output claims or generate new ones.
Copy file name to clipboardExpand all lines: articles/active-directory-domain-services/network-considerations.md
+4-5Lines changed: 4 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,12 +5,11 @@ services: active-directory-ds
5
5
author: iainfoulds
6
6
manager: daveba
7
7
8
-
ms.assetid: 23a857a5-2720-400a-ab9b-1ba61e7b145a
9
8
ms.service: active-directory
10
9
ms.subservice: domain-services
11
10
ms.workload: identity
12
11
ms.topic: conceptual
13
-
ms.date: 01/21/2020
12
+
ms.date: 03/30/2020
14
13
ms.author: iainfou
15
14
16
15
---
@@ -72,7 +71,7 @@ You can connect a virtual network to another virtual network (VNet-to-VNet) in t
72
71
73
72
74
73
75
-
For more information on using virtual private networking, read [Configure a VNet-to-VNet VPN gateway connection by using the Azure portal](https://docs.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-manager-portal).
74
+
For more information on using virtual private networking, read [Configure a VNet-to-VNet VPN gateway connection by using the Azure portal](../vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-manager-portal.md).
76
75
77
76
## Name resolution when connecting virtual networks
78
77
@@ -93,11 +92,11 @@ An Azure AD DS managed domain creates some networking resources during deploymen
93
92
| Load balancer rules | When an Azure AD DS managed domain is configured for secure LDAP on TCP port 636, three rules are created and used on a load balancer to distribute the traffic. |
94
93
95
94
> [!WARNING]
96
-
> Don't delete any of the network resource created by Azure AD DS. If you delete any of the network resources, an Azure AD DS service outage occurs.
95
+
> Don't delete or modify any of the network resource created by Azure AD DS, such as manually configuring the load balancer or rules. If you delete or modify any of the network resources, an Azure AD DS service outage may occur.
97
96
98
97
## Network security groups and required ports
99
98
100
-
A [network security group (NSG)](https://docs.microsoft.com/azure/virtual-network/virtual-networks-nsg) contains a list of rules that allow or deny network traffic to traffic in an Azure virtual network. A network security group is created when you deploy Azure AD DS that contains a set of rules that let the service provide authentication and management functions. This default network security group is associated with the virtual network subnet your Azure AD DS managed domain is deployed into.
99
+
A [network security group (NSG)](../virtual-network/virtual-networks-nsg.md) contains a list of rules that allow or deny network traffic to traffic in an Azure virtual network. A network security group is created when you deploy Azure AD DS that contains a set of rules that let the service provide authentication and management functions. This default network security group is associated with the virtual network subnet your Azure AD DS managed domain is deployed into.
101
100
102
101
The following network security group rules are required for Azure AD DS to provide authentication and management services. Don't edit or delete these network security group rules for the virtual network subnet your Azure AD DS managed domain is deployed into.
0 commit comments