Skip to content

Commit 608f347

Browse files
kengaderduskengaderdus
committed
address local accounts sign in review comment - add combined local and social account
1 parent b0065df commit 608f347

File tree

3 files changed

+162
-16
lines changed

3 files changed

+162
-16
lines changed

‎articles/active-directory-b2c/custom-policies-series-sign-up-or-sign-in-federation.md

Lines changed: 161 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@ In the `ContosoCustomPolicy.XML` file, locate the *ClaimsTransformations* elemen
154154

155155
We've defined three Claims Transformations, which we use to generate values for *alternativeSecurityId* and *userPrincipalName* claims. These ClaimsTransformations are invoked in the OAuth2 Technical Profile in [step 3.3](#step-33---configure-facebook-claims-provider).
156156

157-
### Step 3.3 - Configure Facebook Claims Provider
157+
### Step 3.3 - Configure Facebook claims provider
158158

159159
To enable users to sign in using a Facebook account, you need to define the account as a claims provider that Azure AD B2C can communicate with through an endpoint. You can define a Facebook account as a claims provider.
160160

@@ -506,18 +506,12 @@ In this article, our user journey orchestration steps only references technical
506506

507507
Use the following steps to add a combined local and social account:
508508

509-
1. Declare a claim, `authenticationSource`, which specifies whether the user was authenticated at Social identity provider or a local account by using the following code:
509+
1. In the `ContosoCustomPolicy.XML` file, locate the `AccountTypeInputCollector` self-asserted technical profile, and then add `authenticationSource` claim in its output claims collection by using the following code:
510510

511511
```xml
512-
<!--<ClaimsSchema>-->
513-
...
514-
<ClaimType Id="authenticationSource">
515-
<DisplayName>AuthenticationSource</DisplayName>
516-
<DataType>string</DataType>
517-
<UserHelpText>Specifies whether the user was authenticated at Social IDP or local account.</UserHelpText>
518-
</ClaimType>
519-
<!--</ClaimsSchema>-->
520-
```
512+
<OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localIdpAuthentication" AlwaysUseDefaultValue="true" />
513+
```
514+
521515
1. In the `UserJourneys` section, add a new user journey, *LocalAndSocialSignInAndSignUp* by using the following code:
522516

523517
```xml
@@ -530,13 +524,165 @@ Use the following steps to add a combined local and social account:
530524
</UserJourney>
531525
<!--</UserJourneys>-->
532526
```
533-
1. Add the orchestration steps
534527

535-
1. In the RelyingParty section, change *DefaultUserJourney's* `ReferenceId` to `LocalAndSocialSignInAndSignUp`
528+
1. In the user journey you just created, *LocalAndSocialSignInAndSignUp*, add orchestration steps by using the following code:
529+
530+
```xml
531+
<!--<UserJourneys>
532+
...
533+
<UserJourney Id="LocalAndSocialSignInAndSignUp">
534+
<OrchestrationSteps>-->
535+
<OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="SignupOrSigninContentDefinition">
536+
<ClaimsProviderSelections>
537+
<ClaimsProviderSelection TargetClaimsExchangeId="FacebookExchange" />
538+
<ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" />
539+
</ClaimsProviderSelections>
540+
<ClaimsExchanges>
541+
<ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="UserSignInCollector" />
542+
</ClaimsExchanges>
543+
</OrchestrationStep>
544+
<!-- Check if the user has selected to sign in using one of the social providers -->
545+
<OrchestrationStep Order="2" Type="ClaimsExchange">
546+
<Preconditions>
547+
<Precondition Type="ClaimsExist" ExecuteActionsIf="true">
548+
<Value>objectId</Value>
549+
<Action>SkipThisOrchestrationStep</Action>
550+
</Precondition>
551+
</Preconditions>
552+
<ClaimsExchanges>
553+
<ClaimsExchange Id="FacebookExchange" TechnicalProfileReferenceId="Facebook-OAUTH" />
554+
<ClaimsExchange Id="AccountTypeInputCollectorClaimsExchange" TechnicalProfileReferenceId="AccountTypeInputCollector"/>
555+
</ClaimsExchanges>
556+
</OrchestrationStep>
557+
558+
<!--For Local sign in option start-->
559+
560+
<OrchestrationStep Order="3" Type="ClaimsExchange">
561+
<Preconditions>
562+
<Precondition Type="ClaimsExist" ExecuteActionsIf="true">
563+
<Value>objectId</Value>
564+
<Action>SkipThisOrchestrationStep</Action>
565+
</Precondition>
566+
<Precondition Type="ClaimEquals" ExecuteActionsIf="true">
567+
<Value>accountType</Value>
568+
<Value>work</Value>
569+
<Action>SkipThisOrchestrationStep</Action>
570+
</Precondition>
571+
<Precondition Type="ClaimEquals" ExecuteActionsIf="true">
572+
<Value>authenticationSource</Value>
573+
<Value>socialIdpAuthentication</Value>
574+
<Action>SkipThisOrchestrationStep</Action>
575+
</Precondition>
576+
</Preconditions>
577+
<ClaimsExchanges>
578+
<ClaimsExchange Id="GetAccessCodeClaimsExchange" TechnicalProfileReferenceId="AccessCodeInputCollector" />
579+
</ClaimsExchanges>
580+
</OrchestrationStep>
581+
582+
<OrchestrationStep Order="4" Type="ClaimsExchange">
583+
<Preconditions>
584+
<Precondition Type="ClaimsExist" ExecuteActionsIf="true">
585+
<Value>objectId</Value>
586+
<Action>SkipThisOrchestrationStep</Action>
587+
</Precondition>
588+
<Precondition Type="ClaimEquals" ExecuteActionsIf="true">
589+
<Value>authenticationSource</Value>
590+
<Value>socialIdpAuthentication</Value>
591+
<Action>SkipThisOrchestrationStep</Action>
592+
</Precondition>
593+
</Preconditions>
594+
<ClaimsExchanges>
595+
<ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="UserInformationCollector" />
596+
</ClaimsExchanges>
597+
</OrchestrationStep>
598+
599+
<OrchestrationStep Order="5" Type="ClaimsExchange">
600+
<Preconditions>
601+
<Precondition Type="ClaimEquals" ExecuteActionsIf="true">
602+
<Value>authenticationSource</Value>
603+
<Value>socialIdpAuthentication</Value>
604+
<Action>SkipThisOrchestrationStep</Action>
605+
</Precondition>
606+
</Preconditions>
607+
<ClaimsExchanges>
608+
<ClaimsExchange Id="AADUserReaderExchange" TechnicalProfileReferenceId="AAD-UserRead"/>
609+
</ClaimsExchanges>
610+
</OrchestrationStep>
611+
<!--For Local sign in option end-->
612+
613+
<!--For social sign in option start-->
614+
<!-- For social IDP authentication, attempt to find the user account in the
615+
directory. -->
616+
<OrchestrationStep Order="6" Type="ClaimsExchange">
617+
<Preconditions>
618+
<Precondition Type="ClaimEquals" ExecuteActionsIf="true">
619+
<Value>authenticationSource</Value>
620+
<Value>localIdpAuthentication</Value>
621+
<Action>SkipThisOrchestrationStep</Action>
622+
</Precondition>
623+
</Preconditions>
624+
<ClaimsExchanges>
625+
<ClaimsExchange Id="AADUserReadUsingAlternativeSecurityId" TechnicalProfileReferenceId="AAD-UserReadUsingAlternativeSecurityId" />
626+
</ClaimsExchanges>
627+
</OrchestrationStep>
628+
629+
<!-- Show self-asserted page only if the directory does not have the user account
630+
already (i.e. we do not have an objectId). -->
631+
<OrchestrationStep Order="7" Type="ClaimsExchange">
632+
<Preconditions>
633+
<Precondition Type="ClaimsExist" ExecuteActionsIf="true">
634+
<Value>objectId</Value>
635+
<Action>SkipThisOrchestrationStep</Action>
636+
</Precondition>
637+
<Precondition Type="ClaimEquals" ExecuteActionsIf="true">
638+
<Value>authenticationSource</Value>
639+
<Value>localIdpAuthentication</Value>
640+
<Action>SkipThisOrchestrationStep</Action>
641+
</Precondition>
642+
</Preconditions>
643+
<ClaimsExchanges>
644+
<ClaimsExchange Id="SelfAsserted-Social" TechnicalProfileReferenceId="SelfAsserted-Social" />
645+
</ClaimsExchanges>
646+
</OrchestrationStep>
647+
648+
<OrchestrationStep Order="8" Type="ClaimsExchange">
649+
<Preconditions>
650+
<Precondition Type="ClaimsExist" ExecuteActionsIf="true">
651+
<Value>objectId</Value>
652+
<Action>SkipThisOrchestrationStep</Action>
653+
</Precondition>
654+
<Precondition Type="ClaimEquals" ExecuteActionsIf="true">
655+
<Value>authenticationSource</Value>
656+
<Value>localIdpAuthentication</Value>
657+
<Action>SkipThisOrchestrationStep</Action>
658+
</Precondition>
659+
</Preconditions>
660+
<ClaimsExchanges>
661+
<ClaimsExchange Id="AADUserWrite" TechnicalProfileReferenceId="AAD-UserWriteUsingAlternativeSecurityId" />
662+
</ClaimsExchanges>
663+
</OrchestrationStep>
664+
<!--For social sign in option end-->
665+
<OrchestrationStep Order="9" Type="ClaimsExchange">
666+
<ClaimsExchanges>
667+
<ClaimsExchange Id="GetMessageClaimsExchange" TechnicalProfileReferenceId="UserInputMessageClaimGenerator"/>
668+
</ClaimsExchanges>
669+
</OrchestrationStep>
670+
671+
<OrchestrationStep Order="10" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
672+
<!-- </OrchestrationSteps>
673+
</UserJourney>
674+
</UserJourneys>-->
675+
```
676+
677+
In the fist step, we specify the options a user needs to choose from in their journey, local or social authentication. In the steps that follow, we use preconditions to track the option the user picked or the stage of the journey at which the user is. For example, we use the `authenticationSource` claim to differentiate between a local authentication journey and a social authentication journey.
678+
679+
1. In the `RelyingParty` section, change *DefaultUserJourney's* `ReferenceId` to `LocalAndSocialSignInAndSignUp`
680+
681+
1. Use the procedure in [step 6](#step-6---upload-policy) and [step 7](#step-7---test-policy) to upload and run your policy. After you run the policy, you'll see a screen similar to the following screenshot.
536682

537-
1. Upload policy file
683+
:::image type="content" source="media/custom-policies-series-sign-up-or-sign-in-federation/screenshot-combined-local-and-social-sign-up-or-sign-in.png" alt-text="A screenshot combined local and social sign up or sign in interface.":::
538684

539-
1. Run policy (include screenshot)
685+
You can observe that a user can sign up or sign in by using either a local account or a social account.
540686

541687
## Next steps
542688

‎articles/active-directory-b2c/custom-policies-series-sign-up-or-sign-in.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -174,7 +174,7 @@ In the `ContosoCustomPolicy.XML` file, locate the `SignInUser` technical profile
174174
Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
175175
<Metadata>
176176
<Item Key="setting.operatingMode">Email</Item>
177-
<Item Key="SignUpTarget">SignUpWithLogonEmailExchange</Item>
177+
<Item Key="SignUpTarget">AccountTypeInputCollectorClaimsExchange</Item>
178178
</Metadata>
179179
<DisplayClaims>
180180
<OutputClaim ClaimTypeReferenceId="email" Required="true" />

‎articles/active-directory-b2c/media/custom-policies-series-sign-up-or-sign-in-federation/screenshot-combined-local-and-social-sign-up-or-sign-in.png

33.5 KB
Loading

0 commit comments

Comments
 (0)