Skip to content

Commit 4e5a0d1

Browse files
PMEds28PMEds28
authored
Merge pull request #274662 from MicrosoftDocs/main
Publish to Live Wednesday 4AM PST 5/08
2 parents e42db84 + b7b98fc commit 4e5a0d1

File tree

41 files changed

+1936
-1169
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+1936
-1169
lines changed

‎.openpublishing.redirection.json

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4000,11 +4000,6 @@
40004000
"redirect_url":"/azure/reliability/reliability-containers",
40014001
"redirect_document_id":false
40024002
},
4003-
{
4004-
"source_path_from_root":"/articles/service-connector/quickstart-cli-aks-connection.md",
4005-
"redirect_url":"/azure/service-connector/quickstart-portal-aks-connection",
4006-
"redirect_document_id":false
4007-
},
40084003
{
40094004
"source_path_from_root":"/articles/aks/generation-2-vm-windows.md",
40104005
"redirect_url":"/azure/aks/generation-2-vm",

‎articles/active-directory-b2c/identity-provider-linkedin.md

Lines changed: 40 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -31,15 +31,15 @@ zone_pivot_groups: b2c-policy-type
3131

3232
## Create a LinkedIn application
3333

34-
To enable sign-in for users with a LinkedIn account in Azure Active Directory B2C (Azure AD B2C), you need to create an application in [LinkedIn Developers website](https://developer.linkedin.com/). For more information, see [Authorization Code Flow](/linkedin/shared/authentication/authorization-code-flow). If you don't already have a LinkedIn account, you can sign up at [https://www.linkedin.com/](https://www.linkedin.com/).
34+
To enable sign-in for users with a LinkedIn account in Azure Active Directory B2C (Azure AD B2C), you need to create an application in [LinkedIn Developers website](https://developer.linkedin.com/). If you don't already have a LinkedIn account, you can sign up at [https://www.linkedin.com/](https://www.linkedin.com/).
3535

3636
1. Sign in to the [LinkedIn Developers website](https://developer.linkedin.com/) with your LinkedIn account credentials.
3737
1. Select **My Apps**, and then click **Create app**.
3838
1. Enter **App name**, **LinkedIn Page**, **Privacy policy URL**, and **App logo**.
3939
1. Agree to the LinkedIn **API Terms of Use** and click **Create app**.
4040
1. Select the **Auth** tab. Under **Authentication Keys**, copy the values for **Client ID** and **Client Secret**. You'll need both of them to configure LinkedIn as an identity provider in your tenant. **Client Secret** is an important security credential.
4141
1. Select the edit pencil next to **Authorized redirect URLs for your app**, and then select **Add redirect URL**. Enter `https://your-tenant-name.b2clogin.com/your-tenant-name.onmicrosoft.com/oauth2/authresp`. If you use a [custom domain](custom-domain.md), enter `https://your-domain-name/your-tenant-name.onmicrosoft.com/oauth2/authresp`. Replace `your-tenant-name` with the name of your tenant, and `your-domain-name` with your custom domain. You need to use all lowercase letters when entering your tenant name even if the tenant is defined with uppercase letters in Azure AD B2C. Select **Update**.
42-
1. By default, your LinkedIn app isn't approved for scopes related to sign in. To request a review, select the **Products** tab, and then select **Sign In with LinkedIn**. When the review is complete, the required scopes will be added to your application.
42+
1. By default, your LinkedIn app isn't approved for scopes related to sign in. To request a review, select the **Products** tab, and then select **Sign In with LinkedIn using OpenID Connect**. When the review is complete, the required scopes will be added to your application.
4343
> [!NOTE]
4444
> You can view the scopes that are currently allowed for your app on the **Auth** tab in the **OAuth 2.0 scopes** section.
4545
@@ -49,11 +49,20 @@ To enable sign-in for users with a LinkedIn account in Azure Active Directory B2
4949

5050
1. Sign in to the [Azure portal](https://portal.azure.com/) as the global administrator of your Azure AD B2C tenant.
5151
1. If you have access to multiple tenants, select the **Settings** icon in the top menu to switch to your Azure AD B2C tenant from the **Directories + subscriptions** menu.
52+
1. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**.
5253
1. Choose **All services** in the top-left corner of the Azure portal, search for and select **Azure AD B2C**.
53-
1. Select **Identity providers**, then select **LinkedIn**.
54-
1. Enter a **Name**. For example, *LinkedIn*.
54+
1. Select **Identity providers**, then select **New OpenID Connect provider**.
55+
1. Enter a **Name**. For example, *LinkedIn-OIDC*.
56+
1. For the **Metadata URL**, enter **https://www.linkedin.com/oauth/.well-known/openid-configuration**.
5557
1. For the **Client ID**, enter the Client ID of the LinkedIn application that you created earlier.
5658
1. For the **Client secret**, enter the Client Secret that you recorded.
59+
1. For the **Scope**, enter **openid profile email**.
60+
1. For the **Response type**, enter **code**.
61+
1. For the **User ID**, enter **email**.
62+
1. For the **Display name**, enter **name**.
63+
1. For the **Given name**, enter **given_name**.
64+
1. For the **Surname**, enter **family_name**.
65+
1. For the **Email**, enter **email**.
5766
1. Select **Save**.
5867

5968
## Add LinkedIn identity provider to a user flow
@@ -62,12 +71,12 @@ At this point, the LinkedIn identity provider has been set up, but it's not yet
6271

6372
1. In your Azure AD B2C tenant, select **User flows**.
6473
1. Click the user flow that you want to add the LinkedIn identity provider.
65-
1. Under the **Social identity providers**, select **LinkedIn**.
74+
1. Under the **Custom identity providers**, select **LinkedIn-OIDC**.
6675
1. Select **Save**.
6776
1. To test your policy, select **Run user flow**.
6877
1. For **Application**, select the web application named *testapp1* that you previously registered. The **Reply URL** should show `https://jwt.ms`.
6978
1. Select the **Run user flow** button.
70-
1. From the sign-up or sign-in page, select **LinkedIn** to sign in with LinkedIn account.
79+
1. From the sign-up or sign-in page, select **LinkedIn-OIDC** to sign in with LinkedIn account.
7180

7281
If the sign-in process is successful, your browser is redirected to `https://jwt.ms`, which displays the contents of the token returned by Azure AD B2C.
7382

@@ -81,6 +90,7 @@ You need to store the client secret that you previously recorded in your Azure A
8190

8291
1. Sign in to the [Azure portal](https://portal.azure.com/).
8392
1. If you have access to multiple tenants, select the **Settings** icon in the top menu to switch to your Azure AD B2C tenant from the **Directories + subscriptions** menu.
93+
1. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**.
8494
1. Choose **All services** in the top-left corner of the Azure portal, and then search for and select **Azure AD B2C**.
8595
1. On the Overview page, select **Identity Experience Framework**.
8696
1. Select **Policy keys** and then select **Add**.
@@ -92,7 +102,7 @@ You need to store the client secret that you previously recorded in your Azure A
92102

93103
## Configure LinkedIn as an identity provider
94104

95-
To enable users to sign in using an LinkedIn account, you need to define the account as a claims provider that Azure AD B2C can communicate with through an endpoint. The endpoint provides a set of claims that are used by Azure AD B2C to verify that a specific user has authenticated.
105+
To enable users to sign in using a LinkedIn account, you need to define the account as a claims provider that Azure AD B2C can communicate with through an endpoint. The endpoint provides a set of claims that are used by Azure AD B2C to verify that a specific user has authenticated.
96106

97107
Define a LinkedIn account as a claims provider by adding it to the **ClaimsProviders** element in the extension file of your policy.
98108

@@ -103,94 +113,45 @@ Define a LinkedIn account as a claims provider by adding it to the **ClaimsProvi
103113
```xml
104114
<ClaimsProvider>
105115
<Domain>linkedin.com</Domain>
106-
<DisplayName>LinkedIn</DisplayName>
116+
<DisplayName>LinkedIn-OIDC</DisplayName>
107117
<TechnicalProfiles>
108-
<TechnicalProfile Id="LinkedIn-OAuth2">
118+
<TechnicalProfile Id="LinkedIn-OIDC">
109119
<DisplayName>LinkedIn</DisplayName>
110-
<Protocol Name="OAuth2" />
120+
<Protocol Name="OpenIdConnect" />
111121
<Metadata>
112-
<Item Key="ProviderName">linkedin</Item>
113-
<Item Key="authorization_endpoint">https://www.linkedin.com/oauth/v2/authorization</Item>
114-
<Item Key="AccessTokenEndpoint">https://www.linkedin.com/oauth/v2/accessToken</Item>
115-
<Item Key="ClaimsEndpoint">https://api.linkedin.com/v2/me</Item>
116-
<Item Key="scope">r_emailaddress r_liteprofile</Item>
117-
<Item Key="HttpBinding">POST</Item>
118-
<Item Key="external_user_identity_claim_id">id</Item>
119-
<Item Key="BearerTokenTransmissionMethod">AuthorizationHeader</Item>
120-
<Item Key="ResolveJsonPathsInJsonTokens">true</Item>
121-
<Item Key="UsePolicyInRedirectUri">false</Item>
122-
<Item Key="client_id">Your LinkedIn application client ID</Item>
122+
<Item Key="METADATA">https://www.linkedin.com/oauth/.well-known/openid-configuration</Item>
123+
<Item Key="scope">openid profile email</Item>
124+
<Item Key="HttpBinding">POST</Item>
125+
<Item Key="response_types">code</Item>
126+
<Item Key="UsePolicyInRedirectUri">false</Item>
127+
<Item Key="client_id">Your LinkedIn application client ID</Item>
123128
</Metadata>
124129
<CryptographicKeys>
125-
<Key Id="client_secret" StorageReferenceId="B2C_1A_LinkedInSecret" />
130+
<Key Id="client_secret" StorageReferenceId="B2C_1A_LinkedInSecret" />
126131
</CryptographicKeys>
127132
<InputClaims />
128133
<OutputClaims>
129-
<OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="id" />
130-
<OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="firstName.localized" />
131-
<OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="lastName.localized" />
132-
<OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="linkedin.com" AlwaysUseDefaultValue="true" />
133-
<OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true" />
134+
<OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="email" />
135+
<OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
136+
<OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="family_name" />
137+
<OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="linkedin.com" AlwaysUseDefaultValue="true" />
138+
<OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true" />
134139
</OutputClaims>
135140
<OutputClaimsTransformations>
136-
<OutputClaimsTransformation ReferenceId="ExtractGivenNameFromLinkedInResponse" />
137-
<OutputClaimsTransformation ReferenceId="ExtractSurNameFromLinkedInResponse" />
138-
<OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
139-
<OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
140-
<OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
141-
<OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
141+
<OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
142+
<OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
143+
<OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
144+
<OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
142145
</OutputClaimsTransformations>
143146
<UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
144-
</TechnicalProfile>
147+
</TechnicalProfile>
145148
</TechnicalProfiles>
146149
</ClaimsProvider>
147150
```
148151

149152
1. Replace the value of **client_id** with the client ID of the LinkedIn application that you previously recorded.
150153
1. Save the file.
151154

152-
### Add the claims transformations
153-
154-
The LinkedIn technical profile requires the **ExtractGivenNameFromLinkedInResponse** and **ExtractSurNameFromLinkedInResponse** claims transformations to be added to the list of ClaimsTransformations. If you don't have a **ClaimsTransformations** element defined in your file, add the parent XML elements as shown below. The claims transformations also need a new claim type defined named **nullStringClaim**.
155-
156-
Add the **BuildingBlocks** element near the top of the *TrustFrameworkExtensions.xml* file. See *TrustFrameworkBase.xml* for an example.
157-
158-
```xml
159-
<BuildingBlocks>
160-
<ClaimsSchema>
161-
<!-- Claim type needed for LinkedIn claims transformations -->
162-
<ClaimType Id="nullStringClaim">
163-
<DisplayName>nullClaim</DisplayName>
164-
<DataType>string</DataType>
165-
<AdminHelpText>A policy claim to store output values from ClaimsTransformations that aren't useful. This claim should not be used in TechnicalProfiles.</AdminHelpText>
166-
<UserHelpText>A policy claim to store output values from ClaimsTransformations that aren't useful. This claim should not be used in TechnicalProfiles.</UserHelpText>
167-
</ClaimType>
168-
</ClaimsSchema>
169-
170-
<ClaimsTransformations>
171-
<!-- Claim transformations needed for LinkedIn technical profile -->
172-
<ClaimsTransformation Id="ExtractGivenNameFromLinkedInResponse" TransformationMethod="GetSingleItemFromJson">
173-
<InputClaims>
174-
<InputClaim ClaimTypeReferenceId="givenName" TransformationClaimType="inputJson" />
175-
</InputClaims>
176-
<OutputClaims>
177-
<OutputClaim ClaimTypeReferenceId="nullStringClaim" TransformationClaimType="key" />
178-
<OutputClaim ClaimTypeReferenceId="givenName" TransformationClaimType="value" />
179-
</OutputClaims>
180-
</ClaimsTransformation>
181-
<ClaimsTransformation Id="ExtractSurNameFromLinkedInResponse" TransformationMethod="GetSingleItemFromJson">
182-
<InputClaims>
183-
<InputClaim ClaimTypeReferenceId="surname" TransformationClaimType="inputJson" />
184-
</InputClaims>
185-
<OutputClaims>
186-
<OutputClaim ClaimTypeReferenceId="nullStringClaim" TransformationClaimType="key" />
187-
<OutputClaim ClaimTypeReferenceId="surname" TransformationClaimType="value" />
188-
</OutputClaims>
189-
</ClaimsTransformation>
190-
</ClaimsTransformations>
191-
</BuildingBlocks>
192-
```
193-
194155
[!INCLUDE [active-directory-b2c-add-identity-provider-to-user-journey](../../includes/active-directory-b2c-add-identity-provider-to-user-journey.md)]
195156

196157

@@ -206,7 +167,7 @@ Add the **BuildingBlocks** element near the top of the *TrustFrameworkExtensions
206167
<OrchestrationStep Order="2" Type="ClaimsExchange">
207168
...
208169
<ClaimsExchanges>
209-
<ClaimsExchange Id="LinkedInExchange" TechnicalProfileReferenceId="LinkedIn-OAuth2" />
170+
<ClaimsExchange Id="LinkedInExchange" TechnicalProfileReferenceId="LinkedIn-OIDC" />
210171
</ClaimsExchanges>
211172
</OrchestrationStep>
212173
```
@@ -218,7 +179,7 @@ Add the **BuildingBlocks** element near the top of the *TrustFrameworkExtensions
218179
1. Select your relying party policy, for example `B2C_1A_signup_signin`.
219180
1. For **Application**, select a web application that you [previously registered](tutorial-register-applications.md). The **Reply URL** should show `https://jwt.ms`.
220181
1. Select the **Run now** button.
221-
1. From the sign-up or sign-in page, select **LinkedIn** to sign in with LinkedIn account.
182+
1. From the sign-up or sign-in page, select **LinkedIn-OIDC** to sign in with LinkedIn account.
222183

223184
If the sign-in process is successful, your browser is redirected to `https://jwt.ms`, which displays the contents of the token returned by Azure AD B2C.
224185

@@ -375,7 +336,7 @@ As part of the LinkedIn migration from v1.0 to v2.0, an additional call to anoth
375336
</OrchestrationStep>
376337
```
377338

378-
Obtaining the email address from LinkedIn during sign-up is optional. If you choose not to obtain the email from LinkedIn but require one during sign up, the user is required to manually enter the email address and validate it.
339+
Obtaining the email address from LinkedIn during sign-up is optional. If you choose not to obtain the email from LinkedIn but require one during sign-up, the user is required to manually enter the email address and validate it.
379340

380341
For a full sample of a policy that uses the LinkedIn identity provider, see the [Custom Policy Starter Pack](https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/tree/master/scenarios/linkedin-identity-provider).
381342

0 commit comments

Comments
 (0)