You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/connect-with-saml-service-providers.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -125,7 +125,7 @@ You can change the value of the `IssuerUri` metadata. This is the issuer URI tha
125
125
<!-- SAML Token Issuer technical profile -->
126
126
<TechnicalProfile Id="Saml2AssertionIssuer">
127
127
<DisplayName>Token Issuer</DisplayName>
128
-
<Protocol Name="None"/>
128
+
<Protocol Name="SAML2"/>
129
129
<OutputTokenFormat>SAML2</OutputTokenFormat>
130
130
<Metadata>
131
131
<!-- The issuer contains the policy name; it should be the same name as configured in the relying party application. B2C_1A_signup_signin_SAML is used below. -->
@@ -138,11 +138,11 @@ You can change the value of the `IssuerUri` metadata. This is the issuer URI tha
|[DefaultSSOSessionProvider](#defaultssosessionprovider)| Azure AD B2C internal session manager. |
33
+
|[ExternalLoginSSOSessionProvider](#externalloginssosessionprovider)| Between Azure AD B2C and OAuth1, OAuth2, or OpenId Connect identity provider. ||
34
+
|[OAuthSSOSessionProvider](#oauthssosessionprovider)| Between an OAuth2 or OpenId connect relying party application and Azure AD B2C. |
35
+
|[SamlSSOSessionProvider](#samlssosessionprovider)| Between Azure AD B2C and SAML identity provider. And between a SAML service provider (relying party application) and Azure AD B2C. |
36
+
37
+
38
+
33
39
34
40
SSO management classes are specified using the `<UseTechnicalProfileForSessionManagement ReferenceId="{ID}" />` element of a technical profile.
35
41
@@ -60,11 +66,11 @@ As the name dictates, this provider does nothing. This provider can be used for
60
66
61
67
### DefaultSSOSessionProvider
62
68
63
-
This provider can be used for storing claims in a session. This provider is typically referenced in a technical profile used for managing local accounts. The following `SM-AAD` technical profile is included in the [custom policy starter pack](custom-policy-get-started.md#custom-policy-starter-pack).
69
+
This provider can be used for storing claims in a session. This provider is typically referenced in a technical profile used for managing local and federated accounts. The following `SM-AAD` technical profile is included in the [custom policy starter pack](custom-policy-get-started.md#custom-policy-starter-pack).
@@ -80,6 +86,7 @@ This provider can be used for storing claims in a session. This provider is typi
80
86
</TechnicalProfile>
81
87
```
82
88
89
+
83
90
The following `SM-MFA` technical profile is included in the [custom policy starter pack](custom-policy-get-started.md#custom-policy-starter-pack)`SocialAndLocalAccountsWithMfa`. This technical profile manages the multi-factor authentication session.
84
91
85
92
```XML
@@ -97,11 +104,11 @@ The following `SM-MFA` technical profile is included in the [custom policy start
97
104
98
105
### ExternalLoginSSOSessionProvider
99
106
100
-
This provider is used to suppress the "choose identity provider" screen. It is typically referenced in a technical profile configured for an external identity provider, such as Facebook. The following `SM-SocialLogin` technical profile is included in the [custom policy starter pack](custom-policy-get-started.md#custom-policy-starter-pack).
107
+
This provider is used to suppress the "choose identity provider" screen, and sign-out from a federated identity provider. It is typically referenced in a technical profile configured for an federated identity provider, such as Facebook, or Azure Active Directory. The following `SM-SocialLogin` technical profile is included in the [custom policy starter pack](custom-policy-get-started.md#custom-policy-starter-pack).
This provider is used for managing the Azure AD B2C SAML sessions between a relying party application or a federated SAML identity provider. When using the SSO provider for storing a SAML identity provider session, the `RegisterServiceProviders` must be set to `false`. The following `SM-Saml-idp` technical profile is used by the [SAML technical profile](saml-technical-profile.md).
141
+
This provider is used for managing the Azure AD B2C SAML sessions between a relying party application or a federated SAML identity provider. When using the SSO provider for storing a SAML identity provider session, the `RegisterServiceProviders` must be set to `false`. The following `SM-Saml-idp` technical profile is used by the [SAML identity provider technical profile](saml-identity-provider-technical-profile.md).
124
142
125
143
```XML
126
144
<TechnicalProfileId="SM-Saml-idp">
@@ -134,10 +152,10 @@ This provider is used for managing the Azure AD B2C SAML sessions between a rely
134
152
135
153
When using the provider for storing the B2C SAML session, the `RegisterServiceProviders` must set to `true`. SAML session logout requires the `SessionIndex` and `NameID` to complete.
136
154
137
-
The following `SM-Saml-idp` technical profile is used by [SAML issuer technical profile](saml-issuer-technical-profile.md)
155
+
The following `SM-Saml-issuer` technical profile is used by [SAML issuer technical profile](saml-issuer-technical-profile.md)
@@ -150,4 +168,6 @@ The following `SM-Saml-idp` technical profile is used by [SAML issuer technical
150
168
| RegisterServiceProviders | No | Indicates that the provider should register all SAML service providers that have been issued an assertion. Possible values: `true` (default), or `false`.|
151
169
152
170
171
+
## Next steps
153
172
173
+
- Learn more about [Azure AD B2C session](session.md).
This article shows you how to enable sign-in for an ADFS user account by using [custom policies](custom-policy-overview.md) in Azure Active Directory B2C (Azure AD B2C). You enable sign-in by adding a [SAML technical profile](saml-technical-profile.md) to a custom policy.
21
+
This article shows you how to enable sign-in for an ADFS user account by using [custom policies](custom-policy-overview.md) in Azure Active Directory B2C (Azure AD B2C). You enable sign-in by adding a [SAML identity provider technical profile](saml-identity-provider-technical-profile.md) to a custom policy.
22
22
23
23
## Prerequisites
24
24
@@ -44,7 +44,7 @@ You need to store your certificate in your Azure AD B2C tenant.
44
44
45
45
If you want users to sign in using an ADFS account, you need to define the account as a claims provider that Azure AD B2C can communicate with through an endpoint. The endpoint provides a set of claims that are used by Azure AD B2C to verify that a specific user has authenticated.
46
46
47
-
You can define an ADFS account as a claims provider by adding it to the **ClaimsProviders** element in the extension file of your policy. For more information, see [define a SAML technical profile](saml-technical-profile.md).
47
+
You can define an ADFS account as a claims provider by adding it to the **ClaimsProviders** element in the extension file of your policy. For more information, see [define a SAML identity provider technical profile](saml-identity-provider-technical-profile.md).
48
48
49
49
1. Open the *TrustFrameworkExtensions.xml*.
50
50
1. Find the **ClaimsProviders** element. If it does not exist, add it under the root element.
This article shows you how to enable sign-in for users from a Salesforce organization using [custom policies](custom-policy-overview.md) in Azure Active Directory B2C (Azure AD B2C). You enable sign-in by adding a [SAML technical profile](saml-technical-profile.md) to a custom policy.
21
+
This article shows you how to enable sign-in for users from a Salesforce organization using [custom policies](custom-policy-overview.md) in Azure Active Directory B2C (Azure AD B2C). You enable sign-in by adding a [SAML identity provider technical profile](saml-identity-provider-technical-profile.md) to a custom policy.
22
22
23
23
## Prerequisites
24
24
@@ -99,7 +99,7 @@ You need to store the certificate that you created in your Azure AD B2C tenant.
99
99
100
100
If you want users to sign in using a Salesforce account, you need to define the account as a claims provider that Azure AD B2C can communicate with through an endpoint. The endpoint provides a set of claims that are used by Azure AD B2C to verify that a specific user has authenticated.
101
101
102
-
You can define a Salesforce account as a claims provider by adding it to the **ClaimsProviders** element in the extension file of your policy. For more information, see [define a SAML technical profile](saml-technical-profile.md).
102
+
You can define a Salesforce account as a claims provider by adding it to the **ClaimsProviders** element in the extension file of your policy. For more information, see [define a SAML identity provider technical profile](saml-identity-provider-technical-profile.md).
103
103
104
104
1. Open the *TrustFrameworkExtensions.xml*.
105
105
1. Find the **ClaimsProviders** element. If it does not exist, add it under the root element.
@@ -60,9 +69,13 @@ The CryptographicKeys element contains the following attributes:
60
69
61
70
| Attribute | Required | Description |
62
71
| --------- | -------- | ----------- |
63
-
| issuer_secret | Yes | The X509 certificate (RSA key set) to use to sign the JWT token. This is the `B2C_1A_TokenSigningKeyContainer` key you cofigured in [Get started with custom policies](custom-policy-get-started.md). |
72
+
| issuer_secret | Yes | The X509 certificate (RSA key set) to use to sign the JWT token. This is the `B2C_1A_TokenSigningKeyContainer` key you configure in [Get started with custom policies](custom-policy-get-started.md). |
64
73
| issuer_refresh_token_key | Yes | The X509 certificate (RSA key set) to use to encrypt the refresh token. You configured the `B2C_1A_TokenEncryptionKeyContainer` key in [Get started with custom policies](custom-policy-get-started.md)|
65
74
75
+
## Session management
76
+
77
+
To configure the Azure AD B2C sessions between a relying party application, the attribute of the `UseTechnicalProfileForSessionManagement` element, reference to [OAuthSSOSessionProvider](custom-policy-reference-sso.md#oauthssosessionprovider) SSO session.
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/openid-connect.md
+2-4Lines changed: 2 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ manager: celestedg
8
8
ms.service: active-directory
9
9
ms.workload: identity
10
10
ms.topic: conceptual
11
-
ms.date: 08/22/2019
11
+
ms.date: 04/27/2020
12
12
ms.author: mimart
13
13
ms.subservice: B2C
14
14
ms.custom: fasttrack-edit
@@ -258,7 +258,7 @@ Error responses look like:
258
258
259
259
## Send a sign-out request
260
260
261
-
When you want to sign the user out of the application, it isn't enough to clear the application's cookies or otherwise end the session with the user. Redirect the user to Azure AD B2C to sign out. If you fail to do so, the user might be able to reauthenticate to your application without entering their credentials again.
261
+
When you want to sign the user out of the application, it isn't enough to clear the application's cookies or otherwise end the session with the user. Redirect the user to Azure AD B2C to sign out. If you fail to do so, the user might be able to reauthenticate to your application without entering their credentials again. For more information, see [Azure AD B2C session](session.md).
262
262
263
263
To sign out the user, redirect the user to the `end_session` endpoint that is listed in the OpenID Connect metadata document described earlier:
264
264
@@ -279,6 +279,4 @@ GET https://{tenant}.b2clogin.com/{tenant}.onmicrosoft.com/{policy}/oauth2/v2.0/
279
279
280
280
After logout, the user is redirected to the URI specified in the `post_logout_redirect_uri` parameter, regardless of the reply URLs that have been specified for the application. However, if a valid `id_token_hint` is passed, Azure AD B2C verifies that the value of `post_logout_redirect_uri` matches one of the application's configured redirect URIs before performing the redirect. If no matching reply URL was configured for the application, an error message is displayed and the user is not redirected.
281
281
282
-
### External identity provider sign-out
283
282
284
-
Directing the user to the `end_session` endpoint clears some of the user's single sign-on state with Azure AD B2C, but it doesn't sign the user out of their social identity provider (IDP) session. If the user selects the same IDP during a subsequent sign-in, they are reauthenticated without entering their credentials. If a user wants to sign out of the application, it doesn't necessarily mean they want to sign out of their Facebook account. However, if local accounts are used, the user's session ends properly.
0 commit comments