|
1 | 1 | ---
|
2 |
| -title: Configure Azure Active Directory B2C with Akamai Web Application Firewall |
| 2 | +title: Configure Azure Active Directory B2C with Akamai Web Application Protector |
3 | 3 | titleSuffix: Azure AD B2C
|
4 |
| -description: Configure Akamai Web application firewall with Azure AD B2C |
| 4 | +description: Configure Akamai Web Application Protector with Azure AD B2C |
5 | 5 | services: active-directory-b2c
|
6 | 6 | author: gargi-sinha
|
7 |
| -manager: CelesteDG |
| 7 | +manager: martinco |
8 | 8 | ms.reviewer: kengaderdus
|
9 |
| - |
10 | 9 | ms.service: active-directory
|
11 | 10 | ms.workload: identity
|
12 | 11 | ms.topic: how-to
|
13 |
| -ms.date: 04/03/2022 |
| 12 | +ms.date: 05/04/2023 |
14 | 13 | ms.author: gasinh
|
15 | 14 | ms.subservice: B2C
|
16 | 15 | ---
|
17 | 16 |
|
18 |
| -# Configure Akamai with Azure Active Directory B2C |
19 |
| - |
20 |
| -In this sample article, learn how to enable [Akamai Web Application Firewall (WAF)](https://www.akamai.com/us/en/resources/web-application-firewall.jsp) solution for Azure Active Directory B2C (Azure AD B2C) tenant using custom domains. Akamai WAF helps organization protect their web applications from malicious attacks that aim to exploit vulnerabilities such as SQL injection and Cross site scripting. |
| 17 | +# Configure Azure Active Directory B2C with Akamai Web Application Protector |
21 | 18 |
|
22 |
| ->[!NOTE] |
23 |
| ->This feature is in public preview. |
| 19 | +Learn to enable Akamai Web Application Protector (WAP) for Azure Active Directory B2C (Azure AD B2C) tenant using custom domains. Akamai WAP helps organization protect their web applications from malicious attacks that aim to exploit vulnerabilities such as SQL injection and Cross site scripting. |
24 | 20 |
|
25 |
| -Benefits of using Akamai WAF solution: |
| 21 | +Learn more on akamai.com: [What Is a Web Application Firewall (WAF)?](https://www.akamai.com/glossary/what-is-a-waf) |
26 | 22 |
|
27 |
| -- An edge platform that allows traffic management to your services. |
| 23 | +Benefits of using WAF: |
28 | 24 |
|
29 |
| -- Can be configured in front of your Azure AD B2C tenant. |
| 25 | +* Control traffic management to your services |
| 26 | +* Configure in front of an Azure AD B2C tenant |
| 27 | +* Manipulate traffic to protect and secure your identity infrastructure |
30 | 28 |
|
31 |
| -- Allows fine grained manipulation of traffic to protect and secure your identity infrastructure. |
| 29 | +This article applies to: |
32 | 30 |
|
33 |
| -This article applies to both [Web Application Protector (WAP)](https://www.akamai.com/us/en/products/security/web-application-protector-enterprise-waf-firewall-ddos-protection.jsp) and [Kona Site Defender (KSD)](https://www.akamai.com/us/en/products/security/kona-site-defender.jsp) WAF solutions that Akamai offers. |
| 31 | +WAP: [Web Application Protector](https://www.akamai.com/products/web-application-protector) |
| 32 | +KSD: [Kona Site Defender](https://www.akamai.com/us/en/products/security/kona-site-defender.jsp) |
34 | 33 |
|
35 | 34 | ## Prerequisites
|
36 | 35 |
|
37 |
| -To get started, you'll need: |
38 |
| - |
39 |
| -- An Azure subscription. If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/). |
40 |
| - |
41 |
| -- [An Azure AD B2C tenant](tutorial-create-tenant.md) that is linked to your Azure subscription. |
42 |
| - |
43 |
| -- An [Akamai WAF](https://www.akamai.com/us/en/akamai-free-trials.jsp) account. |
| 36 | +* An Azure subscription |
| 37 | + * If you don't have one, get an [Azure free account](https://azure.microsoft.com/free/) |
| 38 | +* An Azure AD B2C tenant linked to your Azure subscription |
| 39 | + * See, [Tutorial: Create an Azure Active Directory B2C tenant](tutorial-create-tenant.md) |
| 40 | +* An Akamai WAP account |
| 41 | + * Go to akamai.com for [Explore all Akamai products and trials](https://www.akamai.com/us/en/akamai-free-trials.jsp) |
44 | 42 |
|
45 | 43 | ## Scenario description
|
46 | 44 |
|
47 |
| -Akamai WAF integration includes the following components: |
| 45 | +Akamai WAP integration includes the following components: |
48 | 46 |
|
49 |
| -- **Azure AD B2C Tenant** – The authorization server, responsible for verifying the user’s credentials using the custom policies defined in the tenant. It's also known as the identity provider. |
50 |
| - |
51 |
| -- [**Azure Front Door**](../frontdoor/front-door-overview.md) – Responsible for enabling custom domains for Azure B2C tenant. All traffic from Akamai WAF will be routed to Azure Front Door before arriving at Azure AD B2C tenant. |
52 |
| - |
53 |
| -- [**Akamai WAF**](https://www.akamai.com/us/en/resources/waf.jsp) – The web application firewall, which manages all traffic that is sent to the authorization server. |
| 47 | +* **Azure AD B2C** – the authorization server that verifies user credentials with custom policies in the tenant. Also known as the identity provider (IdP). |
| 48 | +* **Azure Front Door** – enables custom domains for the Azure B2C tenant |
| 49 | + * Traffic from Akamai WAP routs to Azure Front Door then goes to the Azure AD B2C tenant |
| 50 | + * [What is Azure Front Door?](../frontdoor/front-door-overview.md) |
| 51 | +* **Akamai WAP** – The web application firewall that manages traffic sent to the authorization server |
| 52 | + * See, [Web Application Protector](https://www.akamai.com/us/en/resources/waf.jsp) |
54 | 53 |
|
55 | 54 | ## Integrate with Azure AD B2C
|
56 | 55 |
|
57 |
| -1. To use custom domains in Azure AD B2C, it's required to use custom domain feature provided by Azure Front Door. Learn how to [enable Azure AD B2C custom domains](./custom-domain.md?pivots=b2c-user-flow). |
| 56 | +For custom domains in Azure AD B2C, use the custom domain feature in Azure Front Door. |
58 | 57 |
|
59 |
| -1. After custom domain for Azure AD B2C is successfully configured using Azure Front Door, [test the custom domain](./custom-domain.md?pivots=b2c-custom-policy#test-your-custom-domain) before proceeding further. |
| 58 | +See, [Enable custom domains for Azure AD B2C](./custom-domain.md?pivots=b2c-user-flow). |
60 | 59 |
|
61 |
| -## Onboard with Akamai |
| 60 | +When the custom domain for Azure AD B2C is configured using Azure Front Door, use the following instructions to test the custom domain. |
62 | 61 |
|
63 |
| -[Sign-up](https://www.akamai.com) and create an Akamai account. |
| 62 | +See, [Test your custom domain](./custom-domain.md?pivots=b2c-custom-policy#test-your-custom-domain), then proceed to the next section. |
64 | 63 |
|
65 |
| -### Create and configure property |
| 64 | +## Create an Akamai account |
66 | 65 |
|
67 |
| -1. [Create a new property](https://control.akamai.com/wh/CUSTOMER/AKAMAI/en-US/WEBHELP/property-manager/property-manager-help/GUID-14BB87F2-282F-4C4A-8043-B422344884E6.html). |
| 66 | +1. Go to [akamai.com](https://www.akamai.com). |
| 67 | +2. Select **Learn more**. |
| 68 | +3. On the **Cloud Computing Services** page, select **Create account**. |
68 | 69 |
|
69 |
| -1. Configure the property settings as: |
| 70 | +### Create and configure a property |
70 | 71 |
|
71 |
| - | Property | Value | |
72 |
| - |:---------------|:---------------| |
73 |
| - |Property version | Select Standard or Enhanced TLS (preferred) | |
74 |
| - |Property hostnames | Add a property hostname. This is the name of your custom domain, for example, `login.domain.com`. <BR> Create or modify a certificate with the appropriate settings for the custom domain name. Learn more about [creating a certificate](https://learn.akamai.com/en-us/webhelp/property-manager/https-delivery-with-property-manager/GUID-9EE0EB6A-E62B-4F5F-9340-60CBD093A429.html). | |
| 72 | +A property is a configuration file that tells our edge servers how to handle and respond to incoming requests from your end users. Properties are created and maintained in Property Manager. |
75 | 73 |
|
76 |
| -1. Set the origin server property configuration settings as: |
| 74 | +To learn more, go to techdocs.akamai.com for [What is a Property?](https://techdocs.akamai.com/start/docs/prop) |
77 | 75 |
|
78 |
| - |Property| Value | |
79 |
| - |:-----------|:-----------| |
80 |
| - | Origin type | Your origin | |
81 |
| - | Origin server hostname | yourafddomain.azurefd.net | |
82 |
| - | Forward host header | Incoming Host Header | |
83 |
| - | Cache key hostname| Incoming Host Header | |
| 76 | +1. Go to control.akamai.com to sign in: [Akamai Control Center sign in page](https://control.akamai.com/wh/CUSTOMER/AKAMAI/en-US/WEBHELP/property-manager/property-manager-help/GUID-14BB87F2-282F-4C4A-8043-B422344884E6.html). |
| 77 | +2. Go to Property Manager. |
| 78 | +3. For **Property version**, select **Standard** or **Enhanced TLS** (recommended). |
| 79 | +4. For **Property hostnames**, add a property hostname, your custom domain. For example, `login.domain.com`. |
84 | 80 |
|
85 |
| -### Configure DNS |
| 81 | + > [!IMPORTANT] |
| 82 | + > Create or modify certificates with correct custom domain name settings. </br> Go to techdocs.akamai.com for [Configure HTTPS hostnames](https://learn.akamai.com/en-us/webhelp/property-manager/https-delivery-with-property-manager/GUID-9EE0EB6A-E62B-4F5F-9340-60CBD093A429.html). |
86 | 83 |
|
87 |
| -Create a CNAME record in your DNS such as `login.domain.com` that points to the Edge hostname in the Property hostname field. |
| 84 | +#### Origin server property configuration settings |
88 | 85 |
|
89 |
| -### Configure Akamai WAF |
| 86 | +Use the following settings for origin server. |
90 | 87 |
|
91 |
| -1. [Configure Akamai WAF](https://learn.akamai.com/en-us/webhelp/kona-site-defender/kona-site-defender-quick-start/GUID-6294B96C-AE8B-4D99-8F43-11B886E6C39A.html#GUID-6294B96C-AE8B-4D99-8F43-11B886E6C39A). |
| 88 | +1. For **Origin type**, enter your type. |
| 89 | +2. For **Origin server hostname** enter your hostname. For example, `yourafddomain.azurefd.net` |
| 90 | +3. For **Forward host header**, use **Incoming Host Header**. |
| 91 | +4. For **Cache key hostname** use **Incoming Host Header**. |
| 92 | + |
| 93 | +### Configure DNS |
92 | 94 |
|
93 |
| -1. Ensure that **Rule Actions** for all items listed under the **Attack Group** are set to **Deny**. |
| 95 | +Create a Canonical Name (CNAME) record in your DNS, such as `login.domain.com`, which points to the Edge hostname in the **Property hostname** field. |
94 | 96 |
|
95 |
| -  |
| 97 | +### Configure Akamai WAP |
96 | 98 |
|
97 |
| -Learn more about [how the control works and configuration options](https://control.akamai.com/dl/security/GUID-81C0214B-602A-4663-839D-68BCBFF41292.html). |
| 99 | +1. To get started with WAP configuration, go to techdocs.akamai.com for [App & API Protector](https://techdocs.akamai.com/cloud-security/docs/app-api-protector). |
| 100 | +2. During configuration, for items in **Attack Group**, under **Rule Actions**, select **Deny**. |
98 | 101 |
|
99 |
| -<!-- docutune:ignore "Security Center" --> |
| 102 | +  |
100 | 103 |
|
101 | 104 | ### Test the settings
|
102 | 105 |
|
103 |
| -Check the following to ensure all traffic to Azure AD B2C is going through the custom domain: |
| 106 | +To ensure traffic to Azure AD B2C goes through the custom domain: |
104 | 107 |
|
105 |
| -- Make sure all incoming requests to Azure AD B2C custom domain are routed via Akamai WAF and using valid TLS connection. |
106 |
| -- Ensure all cookies are set correctly by Azure AD B2C for the custom domain. |
107 |
| -- The Akamai WAF dashboard available under Defender for Cloud console display charts for all traffic that pass through the WAF along with any attack traffic. |
| 108 | +* Confirm WAP routes incoming requests to the Azure AD B2C custom domain |
| 109 | + * Ensure a valid TLS connection |
| 110 | +* Ensure Azure AD B2C sets cookies correctly for the custom domain |
| 111 | +* The WAP dashboard in Defender for Cloud console has WAP traffic charts |
| 112 | + * Attack traffic also appears |
108 | 113 |
|
109 | 114 | ## Next steps
|
110 | 115 |
|
111 |
| -- [Configure a custom domain in Azure AD B2C](./custom-domain.md?pivots=b2c-user-flow) |
| 116 | +* [Enable custom domains for Azure Active Directory B2C](./custom-domain.md?pivots=b2c-user-flow) |
| 117 | +* [Tutorial: Create user flows and custom policies in Azure AD B2C](./tutorial-create-user-flows.md?pivots=b2c-custom-policy&tabs=applications) |
112 | 118 |
|
113 |
| -- [Get started with custom policies in Azure AD B2C](./tutorial-create-user-flows.md?pivots=b2c-custom-policy&tabs=applications) |
|
0 commit comments