Skip to content

Commit 4cd9fa0

Browse files
Banani-RathBanani-Rath
committed
Merging changes synced from https://github.com/MicrosoftDocs/azure-docs-pr (branch live)
2 parents 9f5aba2 + e6d9aaa commit 4cd9fa0

File tree

253 files changed

+1993
-1263
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

253 files changed

+1993
-1263
lines changed

‎articles/active-directory-b2c/TOC.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -265,6 +265,9 @@
265265
href: identity-provider-salesforce.md
266266
- name: Salesforce (SAML)
267267
href: identity-provider-salesforce-saml.md
268+
- name: SwissID
269+
href: identity-provider-swissid.md
270+
displayName: Swiss ID
268271
- name: Twitter
269272
href: identity-provider-twitter.md
270273
- name: WeChat

‎articles/active-directory-b2c/add-identity-provider.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ You typically use only one identity provider in your applications, but you have
4747
* [QQ](identity-provider-qq.md)
4848
* [Salesforce](identity-provider-salesforce.md)
4949
* [Salesforce (SAML protocol)](identity-provider-salesforce-saml.md)
50+
* [SwissID]( identity-provider-swissid.md)
5051
* [Twitter](identity-provider-twitter.md)
5152
* [WeChat](identity-provider-wechat.md)
5253
* [Weibo](identity-provider-weibo.md)

‎articles/active-directory-b2c/identity-provider-swissid.md

Lines changed: 211 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,211 @@
1+
---
2+
title: Set up sign-up and sign-in with a SwissID account
3+
titleSuffix: Azure AD B2C
4+
description: Provide sign-up and sign-in to customers with SwissID accounts in your applications using Azure Active Directory B2C.
5+
services: active-directory-b2c
6+
author: kengaderdus
7+
manager: celestedg
8+
9+
ms.service: active-directory
10+
ms.workload: identity
11+
ms.topic: how-to
12+
ms.date: 12/07/2021
13+
ms.author: kengaderdus
14+
ms.subservice: B2C
15+
zone_pivot_groups: b2c-policy-type
16+
---
17+
18+
# Set up sign-up and sign-in with a SwissID account using Azure Active Directory B2C
19+
20+
[!INCLUDE [active-directory-b2c-choose-user-flow-or-custom-policy](../../includes/active-directory-b2c-choose-user-flow-or-custom-policy.md)]
21+
22+
In this article, you learn how to provide sign-up and sign-in to customers with [SwissID](https://www.swissid.ch/) accounts in your applications using Azure Active Directory B2C (Azure AD B2C). You add the SwissID to your user flows or custom policy using OpenID Connect protocol. For more information, see [SwissID Integration Guidelines – OpenID Connect](https://www.swissid.ch/dam/jcr:471f63c6-606e-4c04-be02-afc99f4d2612).
23+
24+
## Prerequisites
25+
26+
[!INCLUDE [active-directory-b2c-customization-prerequisites](../../includes/active-directory-b2c-customization-prerequisites.md)]
27+
28+
## Create a SwissID application
29+
30+
To enable sign-in for users with a SwissID account in Azure AD B2C, you need to create an application. To create SwissID application, follow these steps:
31+
32+
1. Contact [SwissID Business Partner support](https://www.swissid.ch/en/b2b-kontakt.html).
33+
1. After the sign up with SwissID, provide information about your Azure AD B2C tenant:
34+
35+
36+
|Key |Note |
37+
|---------|---------|
38+
|Redirect URI | Provide the `https://your-tenant-name.b2clogin.com/your-tenant-name.onmicrosoft.com/oauth2/authresp` URI. If you use a [custom domain](custom-domain.md), enter `https://your-domain-name/your-tenant-name.onmicrosoft.com/oauth2/authresp`. Replace `your-tenant-name` with the name of your tenant, and `your-domain-name` with your custom domain. |
39+
|Token endpoint authentication method| `client_secret_post`|
40+
41+
42+
1. After the app is registered, the following information will be provided by the SwissID. Use this information to configure your user flow, or custom policy.
43+
44+
45+
|Key |Note |
46+
|---------|---------|
47+
| Environment| The SwissID OpenId well-known configuration endpoint. For example, <https://login.sandbox.pre.swissid.ch/idp/oauth2/.well-known/openid-configuration>. |
48+
| Client ID | The SwissID client ID. For example, 11111111-2222-3333-4444-555555555555. |
49+
| Password| The SwissID client secret.|
50+
51+
52+
::: zone pivot="b2c-user-flow"
53+
54+
## Configure SwissID as an identity provider
55+
56+
1. Make sure you're using the directory that contains Azure AD B2C tenant. Select the **Directory + subscription** filter in the top menu and choose the directory that contains your Azure AD B2C tenant.
57+
1. Choose **All services** in the top-left corner of the Azure portal, and then search for and select **Azure AD B2C**.
58+
1. Select **Identity providers**, and then select **New OpenID Connect provider**.
59+
1. Enter a **Name**. For example, enter *SwissID*.
60+
1. For **Metadata url**, enter the URL SwissID OpenId well-known configuration endpoint. For example:
61+
62+
```http
63+
https://login.sandbox.pre.swissid.ch/idp/oauth2/.well-known/openid-configuration
64+
```
65+
66+
1. For **Client ID**, enter the SwissID Client ID.
67+
1. For **Client secret**, enter the SwissID client secret.
68+
1. For the **Scope**, enter the `openid profile email`.
69+
1. Leave the default values for **Response type**, and **Response mode**.
70+
1. (Optional) For the **Domain hint**, enter `swissid.com`. For more information, see [Set up direct sign-in using Azure Active Directory B2C](direct-signin.md#redirect-sign-in-to-a-social-provider).
71+
1. Under **Identity provider claims mapping**, select the following claims:
72+
73+
- **User ID**: *sub*
74+
- **Given name**: *given_name*
75+
- **Surname**: *family_name*
76+
- **Email**: *email*
77+
78+
1. Select **Save**.
79+
80+
## Add SwissID identity provider to a user flow
81+
82+
At this point, the SwissID identity provider has been set up, but it's not yet available in any of the sign-in pages. To add the SwissID identity provider to a user flow:
83+
84+
1. In your Azure AD B2C tenant, select **User flows**.
85+
1. Click the user flow that you want to add the SwissID identity provider.
86+
1. Under the **Social identity providers**, select **SwissID**.
87+
1. Select **Save**.
88+
1. To test your policy, select **Run user flow**.
89+
1. For **Application**, select the web application named *testapp1* that you previously registered. The **Reply URL** should show `https://jwt.ms`.
90+
1. Select the **Run user flow** button.
91+
1. From the sign-up or sign-in page, select **SwissID** to sign in with SwissID account.
92+
93+
If the sign-in process is successful, your browser is redirected to `https://jwt.ms`, which displays the contents of the token returned by Azure AD B2C.
94+
95+
::: zone-end
96+
97+
::: zone pivot="b2c-custom-policy"
98+
99+
## Create a policy key
100+
101+
You need to store the client secret that you received from SwissID in your Azure AD B2C tenant.
102+
103+
1. Sign in to the [Azure portal](https://portal.azure.com/).
104+
2. Make sure you're using the directory that contains your Azure AD B2C tenant. Select the **Directory + subscription** filter in the top menu and choose the directory that contains your tenant.
105+
3. Choose **All services** in the top-left corner of the Azure portal, and then search for and select **Azure AD B2C**.
106+
4. On the Overview page, select **Identity Experience Framework**.
107+
5. Select **Policy Keys** and then select **Add**.
108+
6. For **Options**, choose `Manual`.
109+
7. Enter a **Name** for the policy key. For example, `SwissIDSecret`. The prefix `B2C_1A_` is added automatically to the name of your key.
110+
8. In **Secret**, enter your SwissID client secret.
111+
9. For **Key usage**, select `Signature`.
112+
10. Click **Create**.
113+
114+
## Configure SwissID as an identity provider
115+
116+
To enable users to sign in using a SwissID account, you need to define the account as a claims provider that Azure AD B2C can communicate with through an endpoint. The endpoint provides a set of claims that are used by Azure AD B2C to verify that a specific user has authenticated.
117+
118+
You can define a SwissID account as a claims provider by adding it to the **ClaimsProviders** element in the extension file of your policy.
119+
120+
1. Open the *TrustFrameworkExtensions.xml*.
121+
2. Find the **ClaimsProviders** element. If it does not exist, add it under the root element.
122+
3. Add a new **ClaimsProvider** as follows:
123+
124+
```xml
125+
<ClaimsProvider>
126+
<Domain>SwissID.com</Domain>
127+
<DisplayName>SwissID</DisplayName>
128+
<TechnicalProfiles>
129+
<TechnicalProfile Id="SwissID-OpenIdConnect">
130+
<DisplayName>SwissID</DisplayName>
131+
<Protocol Name="OpenIdConnect" />
132+
<Metadata>
133+
<Item Key="METADATA">https://login.sandbox.pre.swissid.ch/idp/oauth2/.well-known/openid-configuration</Item>
134+
<Item Key="client_id">Your Swiss client ID</Item>
135+
<Item Key="response_types">code</Item>
136+
<Item Key="scope">openid profile email</Item>
137+
<Item Key="response_mode">form_post</Item>
138+
<Item Key="HttpBinding">POST</Item>
139+
<Item Key="UsePolicyInRedirectUri">false</Item>
140+
</Metadata>
141+
<CryptographicKeys>
142+
<Key Id="client_secret" StorageReferenceId="B2C_1A_SwissIDSecret" />
143+
</CryptographicKeys>
144+
<OutputClaims>
145+
<OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="sub" />
146+
<OutputClaim ClaimTypeReferenceId="identityProvider" PartnerClaimType="iss" />
147+
<OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true" />
148+
<OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
149+
<OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name" />
150+
<OutputClaim ClaimTypeReferenceId="email" />
151+
</OutputClaims>
152+
<OutputClaimsTransformations>
153+
<OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
154+
<OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
155+
<OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
156+
<OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
157+
<OutputClaimsTransformation ReferenceId="CreateDisplayName" />
158+
</OutputClaimsTransformations>
159+
<UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
160+
</TechnicalProfile>
161+
</TechnicalProfiles>
162+
</ClaimsProvider>
163+
```
164+
165+
4. Set **client_id** to the SwissID client ID.
166+
5. Save the file.
167+
168+
[!INCLUDE [active-directory-b2c-add-identity-provider-to-user-journey](../../includes/active-directory-b2c-add-identity-provider-to-user-journey.md)]
169+
170+
171+
```xml
172+
<OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
173+
<ClaimsProviderSelections>
174+
...
175+
<ClaimsProviderSelection TargetClaimsExchangeId="SwissIDExchange" />
176+
</ClaimsProviderSelections>
177+
...
178+
</OrchestrationStep>
179+
180+
<OrchestrationStep Order="2" Type="ClaimsExchange">
181+
...
182+
<ClaimsExchanges>
183+
<ClaimsExchange Id="SwissIDExchange" TechnicalProfileReferenceId="SwissID-OpenIdConnect" />
184+
</ClaimsExchanges>
185+
</OrchestrationStep>
186+
```
187+
188+
[!INCLUDE [active-directory-b2c-configure-relying-party-policy](../../includes/active-directory-b2c-configure-relying-party-policy-user-journey.md)]
189+
190+
## Test your custom policy
191+
192+
1. Select your relying party policy, for example `B2C_1A_signup_signin`.
193+
1. For **Application**, select a web application that you [previously registered](tutorial-register-applications.md). The **Reply URL** should show `https://jwt.ms`.
194+
1. Select the **Run now** button.
195+
1. From the sign-up or sign-in page, select **SwissID** to sign in with SwissID account.
196+
197+
If the sign-in process is successful, your browser is redirected to `https://jwt.ms`, which displays the contents of the token returned by Azure AD B2C.
198+
199+
200+
::: zone-end
201+
202+
## Move to production
203+
204+
SwissID IdP provides Pre-production and Production environments. The configuration described in this article uses the pre-production environment. To use the production environment, follow these steps:
205+
206+
1. Contact SwissId support for a production environment.
207+
1. Update your user flow or custom policy with the URI of the well-known configuration endpoint.
208+
209+
## Next steps
210+
211+
Learn how to [pass SwissID token to your application](idp-pass-through-user-flow.md).

‎articles/active-directory-b2c/partner-haventec.md

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
title: Tutorial to configure Azure Active Directory B2C with Haventec
33
titleSuffix: Azure AD B2C
44
description: Learn how to integrate Azure AD B2C authentication with Haventec for multifactor passwordless authentication
5-
services: active-directory-b2c
65
author: gargi-sinha
76
manager: martinco
87
ms.service: active-directory
@@ -52,13 +51,13 @@ To get started, you'll need:
5251
- An Azure AD subscription. If you don\'t have one, get a [free
5352
account](https://azure.microsoft.com/free/).
5453

55-
- An [Azure AD B2C tenant](https://docs.microsoft.com/azure/active-directory-b2c/tutorial-create-tenant) that is linked to your Azure subscription.
54+
- An [Azure AD B2C tenant](tutorial-create-tenant.md) that is linked to your Azure subscription.
5655

5756
- A Haventec Authenticate [demo environment](https://www.haventec.com/products/get-started).
5857

5958
### Part - 1 Create an application registration in Haventec
6059

61-
If you haven't already done so, [register](https://docs.microsoft.com/azure/active-directory-b2c/tutorial-register-applications) a web application, and [enable ID token implicit grant](https://docs.microsoft.com/azure/active-directory-b2c/tutorial-register-applications#enable-id-token-implicit-grant).
60+
If you haven't already done so, [register](tutorial-register-applications.md) a web application, and [enable ID token implicit grant](tutorial-register-applications.md#enable-id-token-implicit-grant).
6261

6362
### Part - 2 Add a new Identity provider in Azure AD B2C
6463

@@ -95,7 +94,7 @@ To configure an identity provider, follow these steps:
9594

9695
3. Select **OK**.
9796

98-
4. Select **Map this identity provider’s claims**.
97+
4. Select **Map this identity provider's claims**.
9998

10099
5. Fill out the form to map the Identity provider:
101100

@@ -159,6 +158,6 @@ For additional information, review the following articles:
159158

160159
- [Haventec](https://docs.haventec.com/) documentation
161160

162-
- [Custom policies in Azure AD B2C](https://docs.microsoft.com/azure/active-directory-b2c/custom-policy-overview)
161+
- [Custom policies in Azure AD B2C](custom-policy-overview.md)
163162

164-
- [Get started with custom policies in Azure AD B2C](https://docs.microsoft.com/azure/active-directory-b2c/custom-policy-get-started?tabs=applications)
163+
- [Get started with custom policies in Azure AD B2C](custom-policy-get-started.md?tabs=applications)

‎articles/active-directory/app-provisioning/known-issues.md

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ description: Learn about known issues when you work with automated application p
44
author: kenwith
55
ms.author: kenwith
66
manager: karenh444
7-
services: active-directory
87
ms.service: active-directory
98
ms.subservice: app-provisioning
109
ms.workload: identity
@@ -117,7 +116,7 @@ The following attributes and objects aren't supported:
117116
- Groups.
118117
- Complex anchors (for example, ObjectTypeName+UserName).
119118
- Binary attributes.
120-
- On-premises applications are sometimes not federated with Azure AD and require local passwords. The on-premises provisioning preview does not support password synchronization. Provisioning initial one-time passwords is supported. Please ensure that you are using the [Redact](https://docs.microsoft.com/azure/active-directory/app-provisioning/functions-for-customizing-application-data#redact) function to redact the passwords from the logs. In the SQL and LDAP connectors, the passwords are not exported on the initial call to the application, but rather a second call with set password.
119+
- On-premises applications are sometimes not federated with Azure AD and require local passwords. The on-premises provisioning preview does not support password synchronization. Provisioning initial one-time passwords is supported. Please ensure that you are using the [Redact](/azure/active-directory/app-provisioning/functions-for-customizing-application-data#redact) function to redact the passwords from the logs. In the SQL and LDAP connectors, the passwords are not exported on the initial call to the application, but rather a second call with set password.
121120

122121
#### SSL certificates
123122
The Azure AD ECMA Connector Host currently requires either an SSL certificate to be trusted by Azure or the provisioning agent to be used. The certificate subject must match the host name the Azure AD ECMA Connector Host is installed on.

‎articles/active-directory/app-provisioning/on-premises-scim-provisioning.md

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
---
22
title: Azure AD on-premises app provisioning to SCIM-enabled apps
33
description: This article describes how to use the Azure AD provisioning service to provision users into an on-premises app that's SCIM enabled.
4-
services: active-directory
54
author: billmath
65
manager: karenh444
76
ms.service: active-directory
@@ -39,7 +38,7 @@ To provision users to SCIM-enabled apps:
3938
1. Wait 20 minutes prior to completing the next step, to provide time for the agent assignment to complete.
4039
1. Provide the URL for your SCIM endpoint in the **Tenant URL** box. An example is https://localhost:8585/scim.
4140
![Screenshot that shows assigning an agent.](./media/on-premises-scim-provisioning/scim-2.png)
42-
1. Select **Test Connection**, and save the credentials. Use the steps [here](https://docs.microsoft.com/azure/active-directory/app-provisioning/on-premises-ecma-troubleshoot#troubleshoot-test-connection-issues) if you run into connectivity issues.
41+
1. Select **Test Connection**, and save the credentials. Use the steps [here](on-premises-ecma-troubleshoot.md#troubleshoot-test-connection-issues) if you run into connectivity issues.
4342
1. Configure any [attribute mappings](customize-application-attributes.md) or [scoping](define-conditional-rules-for-provisioning-user-accounts.md) rules required for your application.
4443
1. Add users to scope by [assigning users and groups](../../active-directory/manage-apps/add-application-portal-assign-users.md) to the application.
4544
1. Test provisioning a few users [on demand](provision-on-demand.md).

‎articles/active-directory/app-provisioning/user-provisioning.md

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
---
22
title: What is automated SaaS app user provisioning in Azure Active Directory
33
description: An introduction to how you can use Azure Active Directory to automatically provision, de-provision, and continuously update user accounts across multiple third-party SaaS applications.
4-
services: active-directory
54
author: kenwith
65
manager: karenh444
76
ms.service: active-directory
@@ -21,7 +20,7 @@ In Azure Active Directory (Azure AD), the term *app provisioning* refers to auto
2120

2221
Azure AD application provisioning refers to automatically creating user identities and roles in the applications that users need access to. In addition to creating user identities, automatic provisioning includes the maintenance and removal of user identities as status or roles change. Common scenarios include provisioning an Azure AD user into SaaS applications like [Dropbox](../../active-directory/saas-apps/dropboxforbusiness-provisioning-tutorial.md), [Salesforce](../../active-directory/saas-apps/salesforce-provisioning-tutorial.md), [ServiceNow](../../active-directory/saas-apps/servicenow-provisioning-tutorial.md), and more.
2322

24-
Azure AD also supports provisioning users into applications hosted on-premises or in a virtual machine, without having to open up any firewalls. If your application supports [SCIM](https://aka.ms/scimoverview), or you've built a SCIM gateway to connect to your legacy application, you can use the Azure AD Provisioning agent to [directly connect](https://docs.microsoft.com/azure/active-directory/app-provisioning/on-premises-scim-provisioning) with your application and automate provisioning and deprovisioning. If you have legacy applications that don't support SCIM and rely on an [LDAP](https://docs.microsoft.com/azure/active-directory/app-provisioning/on-premises-ldap-connector-configure) user store or a [SQL](https://docs.microsoft.com/azure/active-directory/app-provisioning/tutorial-ecma-sql-connector) database, Azure AD can support those as well.
23+
Azure AD also supports provisioning users into applications hosted on-premises or in a virtual machine, without having to open up any firewalls. If your application supports [SCIM](https://aka.ms/scimoverview), or you've built a SCIM gateway to connect to your legacy application, you can use the Azure AD Provisioning agent to [directly connect](/azure/active-directory/app-provisioning/on-premises-scim-provisioning) with your application and automate provisioning and deprovisioning. If you have legacy applications that don't support SCIM and rely on an [LDAP](/azure/active-directory/app-provisioning/on-premises-ldap-connector-configure) user store or a [SQL](/azure/active-directory/app-provisioning/tutorial-ecma-sql-connector) database, Azure AD can support those as well.
2524

2625
App provisioning lets you:
2726

0 commit comments

Comments
 (0)