Skip to content

Commit 600daac

Browse files
v-edmckillopv-edmckillop
authored
Update partner-eid-me.md
1 parent f21f726 commit 600daac

File tree

1 file changed

+95
-125
lines changed

1 file changed

+95
-125
lines changed

‎articles/active-directory-b2c/partner-eid-me.md

Lines changed: 95 additions & 125 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,8 @@ zone_pivot_groups: b2c-policy-type
1818

1919
## Before you begin
2020

21-
Azure Active Directory B2C (Azure AD B2C) has two methods to define users interaction with applications: predefined user flows, or configurable custom policies. See, [User flows and custom policies overview](./user-flow-overview.md)
21+
Azure Active Directory B2C (Azure AD B2C) has two methods to define users interaction with applications: predefined user flows, or configurable custom policies.
22+
Custom policies address complex scenarios. For most scenarios, we recommend user flows. See, [User flows and custom policies overview](./user-flow-overview.md)
2223

2324
## Integrate Azure AD B2C authentication with eID-Me
2425

@@ -79,142 +80,111 @@ The following diagram illustrates Azure AD B2C integration with eID-Me.
7980

8081
## Get started with eID-Me
8182

82-
[Contact eID-Me](https://bluink.ca/contact) and configure a test or production environment to set up Azure AD B2C tenants as a Relying Party. Tenants must determine what identity claims they'll need from their consumers as they sign up using eID-Me.
83+
Go to the bluink.ca [Contact Us](https://bluink.ca/contact) page to request a demo with the goal of configuring a test or production environment to set up Azure AD B2C tenants as a relying party. Tenants determine identity claims needed from consumers that sign up with eID-Me.
8384

84-
## Step 1: Configure an application in eID-Me
85+
## Configure an application in eID-Me
8586

86-
To configure your tenant application as a Relying Party in eID-Me the following information should be supplied to eID-Me:
87+
To configure your tenant application as an eID-ME relying party in eID-Me, supply the following information:
8788

8889
| Property | Description|
8990
| ---- | --- |
90-
| Name | Azure AD B2C/your desired application name |
91+
| Name | Azure AD B2C, or another application name |
9192
| Domain| name.onmicrosoft.com|
9293
| Redirect URIs| https://jwt.ms|
93-
| Redirect URLs| `https://your-B2C-tenant-name.b2clogin.com/your-B2C-tenant-name.onmicrosoft.com/oauth2/authresp`<br>For Example: `https://fabrikam.b2clogin.com/fabrikam.onmicrosoft.com/oauth2/authresp`<br>If you use a custom domain, enter https://your-domain-name/your-tenant-name.onmicrosoft.com/oauth2/authresp.<br> Replace your-domain-name with your custom domain, and your-tenant-name with the name of your tenant. |
94-
| URL for application home page| Will be displayed to the end user|
95-
| URL for application privacy policy | Will be displayed to the end user|
96-
97-
eID-Me will provide a Client ID and a Client Secret once the Relying Party has been configured with eID-Me.
94+
| Redirect URLs| `https://your-B2C-tenant-name.b2clogin.com/your-B2C-tenant-name.onmicrosoft.com/oauth2/authresp`<br>For Example: `https://fabrikam.b2clogin.com/fabrikam.onmicrosoft.com/oauth2/authresp`<br>For a custom domain, enter https://your-domain-name/your-tenant-name.onmicrosoft.com/oauth2/authresp.|
95+
| Application home page URL| Appears to the end user|
96+
| Application privacy policy URL| Appears to the end user|
9897

9998
>[!NOTE]
100-
>You'll need Client ID and Client secret later to configure the Identity provider in Azure AD B2C.
101-
102-
## Step 2: Add a new Identity provider in Azure AD B2C
103-
104-
1. Sign in to the [Azure portal](https://portal.azure.com/#home) as the global administrator of your Azure AD B2C tenant.
105-
106-
2. Make sure you're using the directory that contains your Azure AD B2C tenant by selecting the **Directory + subscription** filter in the top menu and choosing the directory that contains your tenant.
107-
108-
3. Choose **All services** in the top-left corner of the Azure portal, search for and select **Azure AD B2C**.
109-
110-
4. Navigate to **Dashboard** > **Azure Active Directory B2C** > **Identity providers**.
111-
112-
5. Select **New OpenID Connect Provider**.
113-
114-
6. Select **Add**.
115-
116-
## Step 3: Configure an Identity provider
117-
118-
To configure an identity provider, follow these steps:
119-
120-
1. Select **Identity provider type** > **OpenID Connect**
99+
>When the relying party is configurede, ID-Me provides a Client ID and a Client Secret. Note the Client ID and Client Secret to configure the identity provider (IdP) in Azure AD B2C.
121100
122-
2. Fill out the form to set up the Identity provider:
101+
## Add a new Identity provider in Azure AD B2C
123102

124-
| Property | Value |
125-
| :------------ | :---------------------------------------------- |
126-
| Name | Enter eID-Me Passwordless/a name of your choice |
127-
| Client ID | Provided by eID-Me |
128-
| Client Secret | Provided by eID-Me |
129-
| Scope | openid email profile |
130-
| Response type | code |
131-
| Response mode | form post |
103+
For the following instructions, use the directory with the Azure AD B2C tenant.
132104

133-
3. Select **OK**.
105+
1. Sign in to the [Azure portal](https://portal.azure.com/#home) as Global Administrator of the Azure AD B2C tenant.
106+
2. In the top menu, select **Directory + subscription**.
107+
3. Select the directory with the tenant.
108+
4. In the top-left corner of the Azure portal, select **All services**.\
109+
5. Search for and select **Azure AD B2C**.
110+
6. Navigate to **Dashboard** > **Azure Active Directory B2C** > **Identity providers**.
111+
7. Select **New OpenID Connect Provider**.
112+
8. Select **Add**.
134113

135-
4. Select **Map this identity provider’s claims**.
114+
## Configure an identity provider
136115

137-
5. Fill out the form to map the Identity provider:
116+
To configure an identity provider:
138117

139-
| Property | Value |
140-
| :----------- | :---------------- |
141-
| User ID | sub |
142-
| Display name | name |
143-
| Given name | given_name |
144-
| Surname | family_name |
145-
| Email | email |
118+
1. Select **Identity provider type** > **OpenID Connect**.
119+
2. In the identity provider form, for **Name**, enter **eID-Me Passwordless** or another name.
120+
3. For **Client ID**, enter the Client ID from eID-Me.
121+
4. For **Client Secret**, enter the Client Secret from eID-Me.
122+
5. For **Scope**, select **openid email profile**.
123+
6. For **Response type**, select **code**.
124+
7. For **Response mode**, selct **form post**.
125+
8. Select **OK**.
126+
9. Select **Map this identity provider’s claims**.
127+
10. For **User ID**, use **sub**.
128+
11. For **Display name**, use **name**.
129+
12. For **Given name**, use **given_name**.
130+
13. For **Surname**, use **family_name**.
131+
14. For **Email**, use **email**.
132+
15. Select **Save**.
146133

147-
6. Select **Save** to complete the setup for your new OIDC Identity provider.
134+
## Configure multi-factor authentication
148135

149-
## Step 4: Configure multi-factor authentication
136+
eID-Me is a multi-factor authenticator, therefore user-flow multi-factor authentication configuration isn't needed.
150137

151-
eID-Me is a decentralized digital identity with strong two-factor user authentication built in. Since eID-Me is already a multi-factor authenticator, you don't need to configure any multi-factor authentication settings in your user flows when using eID-Me. eID-Me offers a fast and simple user experience, which also eliminates the need for any additional passwords.
138+
## Create a user flow policy
152139

153-
## Step 5: Create a user flow policy
154-
155-
You should now see eID-Me as a new OIDC Identity provider listed within your B2C identity providers.
156-
157-
1. In your Azure AD B2C tenant, under **Policies**, select **User flows**.
158-
159-
2. Select **New user flow**
140+
For the following instructions eID-Me appears as a new OIDC identity provider in B2C identity providers.
160141

142+
1. In the Azure AD B2C tenant, under **Policies**, select **User flows**.
143+
2. Select **New user flow**.
161144
3. Select **Sign up and sign in** > **Version** > **Create**.
162-
163-
4. Enter a **Name** for your policy.
164-
165-
5. In the Identity providers section, select your newly created eID-Me Identity provider.
166-
167-
6. Select **None** for Local Accounts to disable email and password-based authentication.
168-
169-
7. Select **Run user flow**
170-
171-
8. In the form, enter the Replying URL, such as `https://jwt.ms`.
172-
173-
9. The browser will be redirected to the eID-Me sign-in page. Enter the account name registered during User registration. The user will receive a push notification to their mobile device where the eID-Me application is installed; upon opening the notification, the user will be presented with an authentication challenge
174-
175-
10. Once the authentication challenge is accepted, the browser will redirect the user to the replying URL.
176-
145+
4. Enter a policy **Name**.
146+
5. In **Identity providers**, select the created eID-Me identity provider.
147+
6. For **Local Accounts** elect **None**. This actions disables email and password authentication.
148+
7. Select **Run user flow**.
149+
8. In the form, enter a **Replying URL**, such as `https://jwt.ms`.
150+
9. The browser redirects to the eID-Me sign-in page.
151+
10. Enter the account name from user registration.
152+
11. The user receives push notification on the mobile device with eID-Me.
153+
12. An authentication challenge appears.
154+
13. The challenge is accepted and the browser redirects to the replying URL.
177155

178156
>[!NOTE]
179-
>In Azure AD B2C, [**custom policies**](./user-flow-overview.md) are designed primarily to address complex scenarios. For most scenarios, we recommend that you use built-in [**user flows**](./user-flow-overview.md).
157+
>Azure Active Directory B2C (Azure AD B2C) has two methods to define users interaction with applications: predefined user flows, or configurable custom policies.
158+
Custom policies address complex scenarios. For most scenarios, we recommend user flows. See, [User flows and custom policies overview](./user-flow-overview.md)
180159

181-
## Step 2: Create a policy key
160+
## Create a policy key
182161

183-
Store the client secret that you previously recorded in your Azure AD B2C tenant.
162+
Store the Client Secret you recorded in your Azure AD B2C tenant. For the following instructions, use the directory with the Azure AD B2C tenant.
184163

185164
1. Sign in to the [Azure portal](https://portal.azure.com/).
186-
187-
2. Make sure you're using the directory that contains your Azure AD B2C tenant. Select the **Directories + subscriptions** icon in the portal toolbar.
188-
189-
3. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**.
190-
191-
4. Choose **All services** in the top-left corner of the Azure portal, and then search for and select **Azure AD B2C**.
192-
193-
5. On the Overview page, select **Identity Experience Framework**.
194-
195-
6. Select **Policy Keys** and then select **Add**.
196-
197-
7. For **Options**, choose `Manual`.
198-
199-
8. Enter a **Name** for the policy key. For example, `eIDMeClientSecret`. The prefix `B2C_1A_` is added automatically to the name of your key.
200-
201-
9. In **Secret**, enter your client secret that you previously recorded.
202-
203-
10. For **Key usage**, select `Signature`.
204-
205-
11. Select **Create**.
206-
207-
## Step 3: Configure eID-Me as an Identity provider
208-
209-
To enable users to sign in using eID-Me decentralized identity, you need to define eID-Me as a claims provider that Azure AD B2C can communicate with through an endpoint. The endpoint provides a set of claims that are used by Azure AD B2C to verify a specific user has authenticated using digital ID available on their device, proving the user’s identity.
210-
211-
You can define eID-Me as a claims provider by adding it to the **ClaimsProvider** element in the extension file of your policy
165+
2. In the portal toolbar, select the **Directories + subscriptions**.
166+
3. On the **Portal settings, Directories + subscriptions** page, in the **Directory name** list, locate your Azure AD B2C directory.
167+
4. Select **Switch**.
168+
5. In the top-left corner of the Azure portal, select **All services**.
169+
6. Search for and select **Azure AD B2C**.
170+
7. On the Overview page, select **Identity Experience Framework**.
171+
8. Select **Policy Keys**.
172+
9. Select **Add**.
173+
10. For **Options**, choose **Manual**.
174+
11. Enter a **Name** for the policy key. For example, `eIDMeClientSecret`. The prefix `B2C_1A_` is added to the key name.
175+
12. In **Secret**, enter the Client Secret you noted.
176+
13. For **Key usage**, select **Signature**.
177+
14. Select **Create**.
178+
179+
## Configure eID-Me as an Identity provider
180+
181+
To enable user sign-in with eID-Me, define eID-Me as a claims provider. Azure AD B2C communicates with it, through an endpoint. The endpoint provides claims used by Azure AD B2C to verify user authentication with a digital ID on their device.
182+
183+
To define eID-Me as a claims provider, add it to the **ClaimsProvider** element in the policy extension file.
212184

213185
1. Open the `TrustFrameworkExtensions.xml`.
214-
215-
2. Find the **ClaimsProviders** element. If it doesn't exist, add it under the root element.
216-
217-
3. Add a new **ClaimsProvider** as follows:
186+
2. Find the **ClaimsProviders** element. If it doesn't appear, add it under the root element.
187+
3. Add a new **ClaimsProvider**:
218188

219189
```xml
220190
<ClaimsProvider>
@@ -266,15 +236,18 @@ You can define eID-Me as a claims provider by adding it to the **ClaimsProvider*
266236
</ClaimsProvider>
267237
```
268238

269-
4. Set **eid_me_rp_client_id** with your eID-Me Relying Party Client ID.
239+
4. For **eid_me_rp_client_id** enter the eID-Me relying-party Client ID.
240+
5. Select **Save**.
270241

271-
5. Save the file.
242+
### Supported identity claims
272243

273-
There are additional identity claims that eID-Me supports and can be added.
244+
You can add additional identity claims that eID-Me supports.
274245

275-
1. Open the `TrustFrameworksExtension.xml`
246+
1. Open the `TrustFrameworksExtension.xml`.
247+
2. Find the `BuildingBlocks` element.
276248

277-
2. Find the `BuildingBlocks` element. This is where additional identity claims that eID-Me supports can be added. Full lists of supported eID-Me identity claims with descriptions are mentioned at `http://www.oid-info.com/get/1.3.6.1.4.1.50715` with the OIDC identifiers used here [https://eid-me.bluink.ca/.well-known/openid-configuration](https://eid-me.bluink.ca/.well-known/openid-configuration).
249+
> [!NOTE]
250+
> Find supported eID-Me identity claims lists on [OID repository](http://www.oid-info.com/get/1.3.6.1.4.1.50715) with OIDC identifiers on [well-known/openid-configuration](https://eid-me.bluink.ca/.well-known/openid-configuration).
278251
279252
```xml
280253
<BuildingBlocks>
@@ -402,21 +375,18 @@ There are additional identity claims that eID-Me supports and can be added.
402375

403376
```
404377

405-
## Step 4: Add a user journey
406-
407-
At this point, the identity provider has been set up, but it's not yet available in any of the sign-in pages. If you don't have your own custom user journey, create a duplicate of an existing template user journey, otherwise continue to the next step.
408-
409-
1. Open the `TrustFrameworkBase.xml` file from the starter pack.
410-
411-
2. Find and copy the entire contents of the **UserJourneys** element that includes ID=`SignUpOrSignIn`.
412-
413-
3. Open the `TrustFrameworkExtensions.xml` and find the **UserJourneys** element. If the element doesn't exist, add one.
378+
## Add a user journey
414379

415-
4. Paste the entire content of the **UserJourney** element that you copied as a child of the **UserJourneys** element.
380+
For the following instructions, the identity provider is set up, but not in any sign-in pages. If you don't have a custom user journey, copy a template user journey.
416381

417-
5. Rename the ID of the user journey. For example, ID=`CustomSignUpSignIn`
382+
1. From the starter pack, open the `TrustFrameworkBase.xml` file.
383+
2. Locate and copy the contents of the **UserJourneys** element that includes ID=`SignUpOrSignIn`.
384+
3. Open the `TrustFrameworkExtensions.xml`.
385+
4. Locate the **UserJourneys** element. If the element doesn't appear, add one.
386+
5. Paste the contents of the **UserJourney** element as a child of the **UserJourneys** element.
387+
6. Rename the user journey ID, for example, ID=`CustomSignUpSignIn`
418388

419-
## Step 5: Add the identity provider to a user journey
389+
## Add the identity provider to a user journey
420390

421391
Now that you have a user journey, add the new identity provider to the user journey.
422392

0 commit comments

Comments
 (0)