Skip to content

Commit 639a969

Browse files
v-edmckillopv-edmckillop
authored
Update partner-bloksec.md
1 parent 9f0accf commit 639a969

File tree

1 file changed

+126
-133
lines changed

1 file changed

+126
-133
lines changed

‎articles/active-directory-b2c/partner-bloksec.md

Lines changed: 126 additions & 133 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ ms.reviewer: kengaderdus
99
ms.service: active-directory
1010
ms.workload: identity
1111
ms.topic: how-to
12-
ms.date: 03/08/2023
12+
ms.date: 03/09/2023
1313
ms.author: gasinh
1414
ms.subservice: B2C
1515
zone_pivot_groups: b2c-policy-type
@@ -40,7 +40,7 @@ BlokSec integration includes the following components:
4040
* **BlokSec SDK-based mobile app** – user PIdP in the decentralized authentication scenario.
4141
* If you're not using the BlokSec SDK, go to Google Play for the free [BlokSec yuID](https://play.google.com/store/apps/details?id=com.bloksec)
4242

43-
The following architecture diagram shows the implementation.
43+
The following architecture diagram illustrates the sign-up, sign-in flow in the BlokSec solution implementation.
4444

4545
![Diagram of the sign-up, sign-in flow in the BlokSec solution implementation.](./media/partner-bloksec/partner-bloksec-architecture-diagram.png)
4646

@@ -50,7 +50,7 @@ The following architecture diagram shows the implementation.
5050
4. User reviews the authentication challenge. An accepted user is prompted for biometry such as fingerprint or facial scan.
5151
5. The response is digitally signed with the user's unique digital key. The authentication response provides proof of possession, presence, and consent. The respond returns to the router.
5252
6. The router verifies the digital signature against the user’s immutable unique public key stored in a distributed ledger. The router replies to Azure AD B2C with the authentication result.
53-
7. User is granted or denied access.
53+
8. User is granted or denied access.
5454

5555
## Enable BlokSec
5656

@@ -93,112 +93,99 @@ Learn more: [Send a sign-out request](./openid-connect.md#send-a-sign-out-reques
9393
>[!NOTE]
9494
>You need application ID and application secret to configure the identity provider (IdP) in Azure AD B2C.
9595
96-
### Add a new Identity provider in Azure AD B2C
96+
### Add a new identity provider in Azure AD B2C
9797

98-
1. Sign-in to the [Azure portal](https://portal.azure.com/#home) as the global administrator of your Azure AD B2C tenant.
99-
1. Make sure you're using the directory that contains your Azure AD B2C tenant. Select the **Directories + subscriptions** icon in the portal toolbar.
100-
1. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**.
101-
1. Choose **All services** in the top-left corner of the Azure portal, then search for and select **Azure AD B2C**.
102-
1. Navigate to **Dashboard** > **Azure Active Directory B2C** > **Identity providers**.
103-
1. Select New **OpenID Connect Provider**.
104-
1. Select **Add**.
98+
For the following instructions, use the directory that contains your Azure AD B2C tenant.
10599

106-
### Part 3 - Configure an Identity provider
100+
1. Sign-in to the [Azure portal](https://portal.azure.com/#home) as Global Administrator of your Azure AD B2C tenant.
101+
2. In the portal toolbar, select **Directories + subscriptions**.
102+
3. On the **Portal settings, Directories + subscriptions** page, in the **Directory name** list, find your Azure AD B2C directory.
103+
4. Select **Switch**.
104+
5. In the top-left corner of the Azure portal, select **All services**.
105+
6. Search for and select **Azure AD B2C**.
106+
7. Navigate to **Dashboard** > **Azure Active Directory B2C** > **Identity providers**.
107+
8. Select **New OpenID Connect Provider**.
108+
9. Select **Add**.
107109

108-
1. Select **Identity provider type > OpenID Connect**
109-
110-
1. Fill out the form to set up the Identity provider:
111-
112-
|Property |Value |
113-
|:---------|:---------|
114-
|Name |Enter BlokSec yuID – Passwordless or a name of your choice|
115-
|Metadata URL| `https://api.bloksec.io/oidc/.well-known/openid-configuration` |
116-
|Client ID|The application ID from the BlokSec admin UI captured in **Part 1**|
117-
|Client Secret|The application Secret from the BlokSec admin UI captured in **Part 1**|
118-
|Scope|OpenID email profile|
119-
|Response type|Code|
120-
|Domain hint|yuID|
121-
122-
1. Select **OK**.
123-
124-
1. Select **Map this identity provider’s claims**.
125-
126-
1. Fill out the form to map the Identity provider:
127-
128-
|Property |Value |
129-
|:---------|:---------|
130-
|User ID|sub|
131-
|Display name|name|
132-
|Given name|given_name|
133-
|Surname|family_name|
134-
|Email|email|
135-
136-
1. Select **Save** to complete the setup for your new OIDC Identity provider.
137-
138-
### Part 4 - User registration
139-
140-
1. Sign-in to BlokSec admin console with the credential provided earlier.
141-
142-
1. Navigate to Azure AD B2C application that was created earlier. Select the gear icon at the top-right, and then select **Create Account**.
110+
### Configure an identity provider
143111

144-
1. Enter the user’s information in the Create Account form, making note of the Account Name, and select **Submit**.
145-
146-
The user will receive an **account registration email** at the provided email address. Have the user follow the registration link on the mobile device where the BlokSec yuID app is installed,
147-
148-
### Part 5 - Create a user flow policy
149-
150-
You should now see BlokSec as a new OIDC Identity provider listed within your B2C identity providers.
112+
1. Select **Identity provider type > OpenID Connect**
113+
2. For name **Name**, enter **BlokSec yuID Passwordless** or another name.
114+
3. For **Metadata URL**, enter `https://api.bloksec.io/oidc/.well-known/openid-configuration`.
115+
4. For **Client IDV**, enter the application ID from the BlokSec admin UI.
116+
5. For **Client Secret**, enter the application Secret from the BlokSec admin UI.
117+
6. For **Scope**, select **OpenID email profile**.
118+
7. For **Response type**, **Code**.
119+
8. For **Domain hint**, select **yuID**.
120+
9. Select **OK**.
121+
10. Select **Map this identity provider’s claims**.
122+
11. For **User ID**, select **sub**.
123+
12. For **Display name**, select **name**.
124+
13. For **Given name**, use **given_name**.
125+
14. For **Surname, use **family_name**.
126+
15. For **Email**, use **email**.
127+
16. Select **Save**.
128+
129+
### User registration
130+
131+
1. Sign in to the BlokSec admin console with the provided credential.
132+
2. Navigate to the Azure AD B2C application created earlier.
133+
3. In the top-right, select the **gear** icon.
134+
4. Select **Create Account**.
135+
5. In **Create Account**, enter user information. Note the Account Name.
136+
6. Select **Submit**.
137+
138+
The user receives an account registration email at the provided email address. Instruct the user to select the registration link on the mobile device with the BlokSec yuID app.
139+
140+
### Create a user flow policy
141+
142+
For the following instructions, ensure BlokSec is a new OIDC identity provider (IdP).
151143

152144
1. In your Azure AD B2C tenant, under **Policies**, select **User flows**.
153-
154-
1. Select **New user flow**
155-
156-
1. Select **Sign up and sign in** > **Version** > **Create**.
157-
158-
1. Enter a **Name** for your policy.
159-
160-
1. In the Identity providers section, select your newly created BlokSec Identity provider.
161-
162-
1. Select **None** for Local Accounts to disable email and password-based authentication.
163-
164-
1. Select **Run user flow**
165-
166-
1. In the form, enter the Replying URL, such as `https://jwt.ms`.
167-
168-
1. The browser will be redirected to the BlokSec login page. Enter the account name registered during User registration. The user will receive a push notification to their mobile device where the BlokSec yuID application is installed; upon opening the notification, the user will be presented with an authentication challenge
169-
170-
1. Once the authentication challenge is accepted, the browser will redirect the user to the replying URL.
145+
2. Select **New user flow**.
146+
3. Select **Sign up and sign in** > **Version** > **Create**.
147+
4. Enter a policy **Name**.
148+
5. In the identity providers section, select the created BlokSec identity provider.
149+
6. For Local Account, select **None**. This disables email and password-based authentication.
150+
7. Select **Run user flow**
151+
8. In the form, enter the Replying URL, such as `https://jwt.ms`.
152+
9. The browser is redirected to the BlokSec sign-in page.
153+
10. Enter the account name from user registration.
154+
11. The user receives a push notification on the mobile device with the BlokSec yuID application.
155+
12. The user opens the notification, and the authentication challenge appears.
156+
13. If authentication is accepted, the browser redirects the user to the replying URL.
171157

172158
>[!NOTE]
173-
>In Azure Active Directory B2C, [custom policies](./user-flow-overview.md) are designed primarily to address complex scenarios. For most scenarios, we recommend that you use built-in [user flows](./user-flow-overview.md).
159+
>In Azure Active Directory B2C, custom policies primarily address complex scenarios. For most scenarios, we recommend built-in user flows.</br> See, [User flows and custom policies overview](./user-flow-overview.md)
174160
175-
### Part 2 - Create a policy key
161+
### Create a policy key
176162

177-
Store the client secret that you previously recorded in your Azure AD B2C tenant.
163+
Store the client secret you noted in your Azure AD B2C tenant. For the following instructions, use the directory with your Azure AD B2C tenant.
178164

179165
1. Sign in to the [Azure portal](https://portal.azure.com/).
180-
1. Make sure you're using the directory that contains your Azure AD B2C tenant. Select the **Directories + subscriptions** icon in the portal toolbar.
181-
1. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**.
182-
1. Choose **All services** in the top-left corner of the Azure portal, and then search for and select **Azure AD B2C**.
183-
1. On the Overview page, select **Identity Experience Framework**.
184-
1. Select **Policy Keys** and then select **Add**.
185-
1. For **Options**, choose `Manual`.
186-
1. Enter a **Name** for the policy key. For example, `BlokSecAppSecret`. The prefix `B2C_1A_` is added automatically to the name of your key.
187-
1. In **Secret**, enter your client secret that you previously recorded.
188-
1. For **Key usage**, select `Signature`.
189-
1. Select **Create**.
190-
191-
### Part 3 - Configure BlokSec as an Identity provider
192-
193-
To enable users to sign in using BlokSec decentralized identity, you need to define BlokSec as a claims provider that Azure AD B2C can communicate with through an endpoint. The endpoint provides a set of claims that are used by Azure AD B2C to verify a specific user has authenticated using biometry such as fingerprint or facial scan as available on their device, proving the user’s identity.
194-
195-
You can define BlokSec as a claims provider by adding it to the **ClaimsProvider** element in the extension file of your policy
166+
2. In the portal toolbar, select **Directories + subscriptions**.
167+
3. On the **Portal settings, Directories + subscriptions** page, in the **Directory name** list, find your Azure AD B2C directory.
168+
4. Select **Switch**.
169+
5. In the top-left corner of the Azure portal, select **All services**
170+
6. Search for and select **Azure AD B2C**.
171+
7. On the **Overview** page, select **Identity Experience Framework**.
172+
8. Select **Policy Keys**.
173+
9. Select **Add**.
174+
10. For **Options**, choose **Manual**.
175+
11. Enter a policy **Name** for the policy key. For example, `BlokSecAppSecret`. The prefix `B2C_1A_` is added to the key name.
176+
12. In **Secret**, enter the client secret you noted.
177+
13. For **Key usage**, select **Signature**.
178+
14. Select **Create**.
179+
180+
### Configure BlokSec as an identity provider
181+
182+
To enable users to sign in using BlokSec decentralized identity, define BlokSec as a claims provider. This action ensure Azure AD B2C communicates with it through an endpoint. Azure AD B2C uses endpoint claims to verify users authenticate identity by using biometry, such as fingerprint or facial scan.
183+
184+
To define BlokSec as a claims provider, add it to the **ClaimsProvider** element in the policy extension file.
196185

197186
1. Open the `TrustFrameworkExtensions.xml`.
198-
199-
2. Find the **ClaimsProviders** element. If it dosen't exist, add it under the root element.
200-
201-
3. Add a new **ClaimsProvider** as follows:
187+
2. Find the **ClaimsProviders** element. If the element doesn't appear, add it under the root element.
188+
3. To add a new **ClaimsProvider**:
202189

203190
```xml
204191
<ClaimsProvider>
@@ -246,32 +233,30 @@ You can define BlokSec as a claims provider by adding it to the **ClaimsProvider
246233
```
247234

248235
4. Set **client_id** to the application ID from the application registration.
236+
5. Select **Save**.
249237

250-
5. Save the file.
251-
252-
### Part 4 - Add a user journey
238+
### Add a user journey
253239

254-
At this point, the identity provider has been set up, but it's not yet available in any of the sign-in pages. If you don't have your own custom user journey, create a duplicate of an existing template user journey, otherwise continue to the next step.
240+
Use the following instructions if the identity provider is set up, but not in any sign-in page. If you don't have a custom user journey, copy a template user journey.
241+
1. From the starter pack, open the `TrustFrameworkBase.xml` file.
242+
2. Find and copy the contents of the **UserJourneys** element that includes ID=`SignUpOrSignIn`.
243+
3. Open the `TrustFrameworkExtensions.xml`.
244+
4. Find the **UserJourneys** element. If the element doesn't appear, add one.
245+
5. Paste the contents of the **UserJourney** element you copied as a child of the **UserJourneys** element.
246+
6. Rename the user journey ID. For example, ID=`CustomSignUpSignIn`.
255247

256-
1. Open the `TrustFrameworkBase.xml` file from the starter pack.
248+
### Add the identity provider to a user journey
257249

258-
2. Find and copy the entire contents of the **UserJourneys** element that includes ID=`SignUpOrSignIn`.
250+
If you have a user journey, add the new identity provider to it. First add a sign-in button, then link it to an action, which is the technical profile you created.
259251

260-
3. Open the `TrustFrameworkExtensions.xml` and find the **UserJourneys** element. If the element doesn't exist, add one.
252+
1. In the user journey, locate the orchestration step element that includes Type=`CombinedSignInAndSignUp`, or Type=`ClaimsProviderSelection`. It's usually the first orchestration step. The **ClaimsProviderSelections** element contains a list of identity providers for user sign-in. The order of the elements controls the order of the sign-in buttons the user sees.
253+
2. Add a **ClaimsProviderSelection** XML element.
254+
3. Set the value of **TargetClaimsExchangeId** to a friendly name.
255+
4. In the next orchestration step, add a **ClaimsExchange** element.
256+
5. Set the **Id** to the value of the target claims exchange ID.
257+
6. Update the value of **TechnicalProfileReferenceId** to the ID of the technical profile you created.
261258

262-
4. Paste the entire content of the **UserJourney** element that you copied as a child of the **UserJourneys** element.
263-
264-
5. Rename the ID of the user journey. For example, ID=`CustomSignUpSignIn`.
265-
266-
### Part 5 - Add the identity provider to a user journey
267-
268-
Now that you have a user journey, add the new identity provider to the user journey. First add a sign-in button, then link the button to an action. The action is the technical profile you created earlier.
269-
270-
1. Find the orchestration step element that includes Type=`CombinedSignInAndSignUp`, or Type=`ClaimsProviderSelection` in the user journey. It's usually the first orchestration step. The **ClaimsProviderSelections** element contains a list of identity providers that a user can sign in with. The order of the elements controls the order of the sign-in buttons presented to the user. Add a **ClaimsProviderSelection** XML element. Set the value of **TargetClaimsExchangeId** to a friendly name.
271-
272-
2. In the next orchestration step, add a **ClaimsExchange** element. Set the **Id** to the value of the target claims exchange ID. Update the value of **TechnicalProfileReferenceId** to the ID of the technical profile you created earlier.
273-
274-
The following XML demonstrates the first two orchestration steps of a user journey with the identity provider:
259+
The following XML demonstrates the first two user-journey orchestration steps with the identity provider:
275260

276261
```xml
277262
<OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
@@ -290,9 +275,12 @@ The following XML demonstrates the first two orchestration steps of a user journ
290275
</OrchestrationStep>
291276
```
292277

293-
### Part 6 - Configure the relying party policy
278+
### Configure the relying party policy
279+
280+
The relying party policy, for example [SignUpSignIn.xml](https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/blob/master/SocialAndLocalAccounts/SignUpOrSignin.xml), specifies the user journey Azure AD B2C executes.
294281

295-
The relying party policy, for example [SignUpSignIn.xml](https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/blob/master/SocialAndLocalAccounts/SignUpOrSignin.xml), specifies the user journey which Azure AD B2C will execute. Find the **DefaultUserJourney** element within relying party. Update the **ReferenceId** to match the user journey ID, in which you added the identity provider.
282+
1. Find the **DefaultUserJourney** element in relying party.
283+
2. Update the **ReferenceId** to match the user journey ID, in which you added the identity provider.
296284

297285
In the following example, for the `CustomSignUpOrSignIn` user journey, the ReferenceId is set to `CustomSignUpOrSignIn`.
298286

@@ -302,30 +290,35 @@ In the following example, for the `CustomSignUpOrSignIn` user journey, the Refer
302290
...
303291
</RelyingParty>
304292
```
293+
### Upload the custom policy
305294

306-
### Part 7 - Upload the custom policy
295+
For the following instructions, use the directory with your Azure AD B2C tenant.
307296

308297
1. Sign in to the [Azure portal](https://portal.azure.com/#home).
309-
1. Make sure you're using the directory that contains your Azure AD B2C tenant. Select the **Directories + subscriptions** icon in the portal toolbar.
310-
1. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**.
311-
1. In the [Azure portal](https://portal.azure.com/#home), search for and select **Azure AD B2C**.
312-
1. Under Policies, select **Identity Experience Framework**.
313-
Select **Upload Custom Policy**, and then upload the two policy files that you changed, in the following order: the extension policy, for example `TrustFrameworkExtensions.xml`, then the relying party policy, such as `SignUpSignIn.xml`.
298+
2. In the portal toolbar, select the **Directories + subscriptions**.
299+
3. On the **Portal settings, Directories + subscriptions** page, in the **Directory name** list, find your Azure AD B2C directory
300+
4. Select **Switch**.
301+
5. In the Azure portal, search for and select **Azure AD B2C**.
302+
6. Under **Policies**, select **Identity Experience Framework**.
303+
7. Select **Upload Custom Policy**.
304+
8. Upload the two policy files you changed in the following order:
305+
306+
* Extension policy, for example `TrustFrameworkExtensions.xml`
307+
* Relying party policy, such as `SignUpSignIn.xml`
314308

315-
### Part 8 - Test your custom policy
309+
### Test the custom policy
316310

317311
1. Select your relying party policy, for example `B2C_1A_signup_signin`.
318-
1. For **Application**, select a web application that you [previously registered](./tutorial-register-applications.md). The **Reply URL** should show `https://jwt.ms`.
319-
1. Select the **Run now** button.
320-
1. From the sign-up or sign-in page, select **Google** to sign in with Google account.
312+
1. For **Application**, select a web application you registered.
313+
2. The **Reply URL** appears as `https://jwt.ms`.
314+
3. Select **Run now**.
315+
4. From the sign-up or sign-in page, select **Google** to sign in with Google account.
316+
5. The browser is redirected to `https://jwt.ms`. See the token contents returned by Azure AD B2C.
321317

322-
If the sign-in process is successful, your browser is redirected to `https://jwt.ms`, which displays the contents of the token returned by Azure AD B2C.
318+
Learn more: [Tutorial: Register a web application in Azure Active Directory B2C](./tutorial-register-applications.md)
323319

324320
## Next steps
325321

326-
For additional information, review the following articles:
327-
328-
- [Custom policies in Azure AD B2C](./custom-policy-overview.md)
329-
330-
- [Get started with custom policies in Azure AD B2C](./tutorial-create-user-flows.md?pivots=b2c-custom-policy)
322+
* [Azure AD B2C custom policy overview](./custom-policy-overview.md)
323+
* [Tutorial: Create user flows and custom policies in Azure AD B2C](./tutorial-create-user-flows.md?pivots=b2c-custom-policy)
331324

0 commit comments

Comments
 (0)