Skip to content

Commit 36bb7b3

Browse files
authored
Merge pull request #259895 from MicrosoftDocs/main
Merge main to live, 4 AM
2 parents b383c6c + adedeef commit 36bb7b3

File tree

50 files changed

+1305
-1300
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+1305
-1300
lines changed

articles/active-directory-b2c/add-password-reset-policy.md

Lines changed: 24 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -2,18 +2,16 @@
22
title: Set up a password reset flow
33
titleSuffix: Azure AD B2C
44
description: Learn how to set up a password reset flow in Azure Active Directory B2C (Azure AD B2C).
5-
65
author: garrodonnell
76
manager: CelesteDG
8-
97
ms.service: active-directory
10-
118
ms.topic: how-to
12-
ms.date: 10/25/2022
13-
ms.custom:
9+
ms.date: 11/27/2023
1410
ms.author: godonnell
1511
ms.subservice: B2C
1612
zone_pivot_groups: b2c-policy-type
13+
14+
#Customer intent: As a developer, I want to enable my users to reset their passwords without the need for admin intervention, so that they can recover their accounts if they forget their passwords.
1715
---
1816

1917
# Set up a password reset flow in Azure Active Directory B2C
@@ -22,38 +20,25 @@ zone_pivot_groups: b2c-policy-type
2220

2321
In a [sign-up and sign-in journey](add-sign-up-and-sign-in-policy.md), a user can reset their own password by using the **Forgot your password?** link. This self-service password reset flow applies to local accounts in Azure Active Directory B2C (Azure AD B2C) that use an [email address](sign-in-options.md#email-sign-in) or a [username](sign-in-options.md#username-sign-in) with a password for sign-in.
2422

23+
> [!TIP]
24+
> A user can change their password by using the self-service password reset flow if they forget their password and want to reset it. You can also choose one of the following user flow options to change a user's password:
25+
> - If a user knows their password and wants to change it, use a [password change flow](add-password-change-policy.md).
26+
> - If you want to force a user to reset their password (for example, when they sign in for the first time, when their passwords have been reset by an admin, or after they've been migrated to Azure AD B2C with random passwords), use a [force password reset](force-password-reset.md) flow.
27+
2528
The password reset flow involves the following steps:
2629

2730
1. On the sign-up and sign-in page, the user selects the **Forgot your password?** link. Azure AD B2C initiates the password reset flow.
2831
1. In the next dialog that appears, the user enters their email address, and then selects **Send verification code**. Azure AD B2C sends a verification code to the user's email account. The user copies the verification code from the email, enters the code in the Azure AD B2C password reset dialog, and then selects **Verify code**.
29-
1. The user can then enter a new password. (After the email is verified, the user can still select the **Change e-mail** button; see [Hide the change email button](#hide-the-change-email-button).)
32+
1. The user can then enter a new password. (After the email is verified, the user can still select the **Change e-mail** button; see [Hide the change email button](#hide-the-change-email-button-optional) if you wish to remove it.)
3033

3134
:::image type="content" source="./media/add-password-reset-policy/password-reset-flow.png" alt-text="Diagram that shows three dialogs in the password reset flow." lightbox="./media/add-password-reset-policy/password-reset-flow.png":::
3235

33-
> [!TIP]
34-
> A user can change their password by using the self-service password reset flow if they forget their password and want to reset it. You can also choose one of the following user flow options:
35-
> - If a user knows their password and wants to change it, use a [password change flow](add-password-change-policy.md).
36-
> - If you want to force a user to reset their password (for example, when they sign in for the first time, when their passwords have been reset by an admin, or after they've been migrated to Azure AD B2C with random passwords), use a [force password reset](force-password-reset.md) flow.
37-
3836
The default name of the **Change email** button in *selfAsserted.html* is **changeclaims**. To find the button name, on the sign-up page, inspect the page source by using a browser tool such as _Inspect_.
3937

4038
## Prerequisites
4139

4240
[!INCLUDE [active-directory-b2c-customization-prerequisites](../../includes/active-directory-b2c-customization-prerequisites.md)]
4341

44-
### Hide the change email button
45-
46-
After the email is verified, the user can still select **Change email**, enter another email address, and then repeat email verification. If you'd prefer to hide the **Change email** button, you can modify the CSS to hide the associated HTML elements in the dialog. For example, you can add the following CSS entry to selfAsserted.html and [customize the user interface by using HTML templates](customize-ui-with-html.md):
47-
48-
```html
49-
<style type="text/css">
50-
.changeClaims
51-
{
52-
visibility: hidden;
53-
}
54-
</style>
55-
```
56-
5742
## Self-service password reset (recommended)
5843

5944
The new password reset experience is now part of the sign-up or sign-in policy. When the user selects the **Forgot your password?** link, they are immediately sent to the Forgot Password experience. Your application no longer needs to handle the [AADB2C90118 error code](#password-reset-policy-legacy), and you don't need a separate policy for password reset.
@@ -292,6 +277,19 @@ Your application might need to detect whether the user signed in by using the Fo
292277

293278
::: zone-end
294279

280+
### Hide the change email button (Optional)
281+
282+
After the email is verified, the user can still select **Change email**, enter another email address, and then repeat email verification. If you'd prefer to hide the **Change email** button, you can modify the CSS to hide the associated HTML elements in the dialog. For example, you can add the following CSS entry to selfAsserted.html and [customize the user interface by using HTML templates](customize-ui-with-html.md):
283+
284+
```html
285+
<style type="text/css">
286+
.changeClaims
287+
{
288+
visibility: hidden;
289+
}
290+
</style>
291+
```
292+
295293
### Test the password reset flow
296294

297295
1. Select a sign-up or sign-in user flow (Recommended type) that you want to test.
@@ -313,9 +311,9 @@ The following diagram depicts the process:
313311
1. The user selects the **Forgot your password?** link. Azure AD B2C returns the `AADB2C90118` error code to the application.
314312
1. The application handles the error code and initiates a new authorization request. The authorization request specifies the password reset policy name, such as *B2C_1_pwd_reset*.
315313

316-
![Diagram that shows the legacy password reset user flow.](./media/add-password-reset-policy/password-reset-flow-legacy.png)
314+
:::image type="content" source="./media/add-password-reset-policy/password-reset-flow-legacy.png" alt-text="Diagram that shows the legacy password reset user flow with numbered steps.":::
317315

318-
You can see a basic [ASP.NET sample](https://github.com/AzureADQuickStarts/B2C-WebApp-OpenIDConnect-DotNet-SUSI), which demonstrates how user flows link.
316+
You can see a basic demonstration of how user flows link in our [ASP.NET sample](https://github.com/AzureADQuickStarts/B2C-WebApp-OpenIDConnect-DotNet-SUSI).
319317

320318
::: zone pivot="b2c-user-flow"
321319

articles/aks/azure-cni-overlay.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,12 @@ You can provide outbound (egress) connectivity to the internet for Overlay pods
2929

3030
You can configure ingress connectivity to the cluster using an ingress controller, such as Nginx or [HTTP application routing](./http-application-routing.md). You cannot configure ingress connectivity using Azure App Gateway. For details see [Limitations with Azure CNI Overlay](#limitations-with-azure-cni-overlay).
3131

32+
## Limitations
33+
34+
Azure CNI Overlay networking in AKS currently has the following limitations:
35+
36+
* In case you are using your own subnet to deploy the cluster, the names of the subnet, VNET and resource group which contains the VNET, must be 63 characters or less. This comes from the fact that these names will be used as labels in AKS worker nodes, and are therefore subjected to [Kubernetes label syntax rules](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set).
37+
3238
## Regional availability for ARM64 node pools
3339

3440
Azure CNI Overlay is currently unavailable for ARM64 node pools in the following regions:
Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
---
2+
author: xiaofanzhou
3+
ms.service: service-connector
4+
ms.topic: include
5+
ms.date: 11/13/2023
6+
ms.author: xiaofanzhou
7+
---
8+
9+
# [.NET](#tab/dotnet-mysql-mi)
10+
For .NET, get an access token for the managed identity using a client library such as [Azure.Identity](https://www.nuget.org/packages/Azure.Identity/). Then use the access token as a password to connect to the database. When using the code below, make sure you uncomment the part of the code snippet that corresponds to the authentication type you want to use.
11+
12+
```csharp
13+
using Azure.Core;
14+
using Azure.Identity;
15+
using MySqlConnector;
16+
17+
// Uncomment the following lines according to the authentication type.
18+
// For system-assigned managed identity.
19+
// var credential = new DefaultAzureCredential();
20+
21+
// For user-assigned managed identity.
22+
// var credential = new DefaultAzureCredential(
23+
// new DefaultAzureCredentialOptions
24+
// {
25+
// ManagedIdentityClientId = Environment.GetEnvironmentVariable("AZURE_MYSQL_CLIENTID");
26+
// });
27+
28+
var tokenRequestContext = new TokenRequestContext(
29+
new[] { "https://ossrdbms-aad.database.windows.net/.default" });
30+
AccessToken accessToken = await credential.GetTokenAsync(tokenRequestContext);
31+
// Open a connection to the MySQL server using the access token.
32+
string connectionString =
33+
$"{Environment.GetEnvironmentVariable("AZURE_MYSQL_CONNECTIONSTRING")};Password={accessToken.Token}";
34+
35+
using var connection = new MySqlConnection(connectionString);
36+
Console.WriteLine("Opening connection using access token...");
37+
await connection.OpenAsync();
38+
39+
// do something
40+
```
41+
42+
# [Java](#tab/java-mysql-mi)
43+
44+
1. Add the following dependencies in your *pom.xml* file:
45+
46+
```xml
47+
<dependency>
48+
<groupId>mysql</groupId>
49+
<artifactId>mysql-connector-java</artifactId>
50+
<version>8.0.30</version>
51+
</dependency>
52+
<dependency>
53+
<groupId>com.azure</groupId>
54+
<artifactId>azure-identity-extensions</artifactId>
55+
<version>1.1.5</version>
56+
</dependency>
57+
```
58+
59+
1. Get the connection string from the environment variable, and add the plugin name to connect to the database:
60+
61+
```java
62+
String url = System.getenv("AZURE_MYSQL_CONNECTIONSTRING");
63+
String pluginName = "com.azure.identity.extensions.jdbc.mysql.AzureMysqlAuthenticationPlugin";
64+
Connection connection = DriverManager.getConnection(url + "&defaultAuthenticationPlugin=" +
65+
pluginName + "&authenticationPlugins=" + pluginName);
66+
```
67+
68+
For more information, see [Use Java and JDBC with Azure Database for MySQL - Flexible Server](../../../mysql/flexible-server/connect-java.md?tabs=passwordless).
69+
70+
# [Python](#tab/python-mysql-mi)
71+
72+
1. Install dependencies.
73+
74+
```bash
75+
pip install azure-identity
76+
# install Connector/Python https://dev.mysql.com/doc/connector-python/en/connector-python-installation.html
77+
pip install mysql-connector-python
78+
```
79+
80+
1. Authenticate with an access token from the `azure-identity` library. Get the connection information from the environment variable added by Service Connector. When using the code below, make sure you uncomment the part of the code snippet that corresponds to the authentication type you want to use.
81+
82+
```python
83+
from azure.identity import ManagedIdentityCredential, ClientSecretCredential
84+
import mysql.connector
85+
import os
86+
87+
# Uncomment the following lines according to the authentication type.
88+
# For system-assigned managed identity.
89+
# cred = ManagedIdentityCredential()
90+
91+
# For user-assigned managed identity.
92+
# managed_identity_client_id = os.getenv('AZURE_MYSQL_CLIENTID')
93+
# cred = ManagedIdentityCredential(client_id=managed_identity_client_id)
94+
95+
# acquire token
96+
accessToken = cred.get_token('https://ossrdbms-aad.database.windows.net/.default')
97+
98+
# open connect to Azure MySQL with the access token.
99+
host = os.getenv('AZURE_MYSQL_HOST')
100+
database = os.getenv('AZURE_MYSQL_NAME')
101+
user = os.getenv('AZURE_MYSQL_USER')
102+
password = accessToken.token
103+
104+
cnx = mysql.connector.connect(user=user,
105+
password=password,
106+
host=host,
107+
database=database)
108+
cnx.close()
109+
110+
```
111+
112+
# [NodeJS](#tab/nodejs-mysql-mi)
113+
114+
1. Install dependencies.
115+
116+
```bash
117+
npm install --save @azure/identity
118+
npm install --save mysql2
119+
```
120+
121+
1. Get an access token using `@azure/identity` and the Azure MySQL database information from the environment variables added by Service Connector. When using the code below, make sure you uncomment the part of the code snippet that corresponds to the authentication type you want to use.
122+
123+
```javascript
124+
import { DefaultAzureCredential,ClientSecretCredential } from "@azure/identity";
125+
126+
const mysql = require('mysql2');
127+
128+
// Uncomment the following lines according to the authentication type.
129+
// for system-assigned managed identity
130+
// const credential = new DefaultAzureCredential();
131+
132+
// for user-assigned managed identity
133+
// const clientId = process.env.AZURE_MYSQL_CLIENTID;
134+
// const credential = new DefaultAzureCredential({
135+
// managedIdentityClientId: clientId
136+
// });
137+
138+
// acquire token
139+
var accessToken = await credential.getToken('https://ossrdbms-aad.database.windows.net/.default');
140+
141+
const connection = mysql.createConnection({
142+
host: process.env.AZURE_MYSQL_HOST,
143+
user: process.env.AZURE_MYSQL_USER,
144+
password: accessToken.token,
145+
database: process.env.AZURE_MYSQL_DATABASE,
146+
port: process.env.AZURE_MYSQL_PORT,
147+
ssl: process.env.AZURE_MYSQL_SSL
148+
});
149+
150+
connection.connect((err) => {
151+
if (err) {
152+
console.error('Error connecting to MySQL database: ' + err.stack);
153+
return;
154+
}
155+
console.log('Connected to MySQL database');
156+
});
157+
```
158+
159+
-----
160+
161+
For more code samples, see [Create a passwordless connection to a database service via Service Connector](/azure/service-connector/tutorial-passwordless?tabs=user%2Cappservice&pivots=mysql#connect-to-a-database-with-microsoft-entra-authentication).

0 commit comments

Comments
 (0)