Skip to content

Commit 6781996

Browse files
v-aljev-alje
authored
Merge pull request #2890 from MicrosoftDocs/FromPrivateRepo
From private repo
2 parents e80877f + e0e2c5e commit 6781996

File tree

474 files changed

+3653
-1135
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

474 files changed

+3653
-1135
lines changed

‎articles/active-directory-b2c/TOC.md

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,9 +56,12 @@
5656
## [Custom policies](active-directory-b2c-overview-custom.md)
5757
## Guides
5858
### [Get started](active-directory-b2c-get-started-custom.md)
59-
### Configure OIDC providers
59+
### Configure OIDC/OAUTH2 providers
6060
#### [Azure AD](active-directory-b2c-setup-aad-custom.md)
61+
#### [Microsoft Account](active-directory-b2c-custom-setup-msa-idp.md)
62+
#### [Google+](active-directory-b2c-custom-setup-goog-idp.md)
6163
### Configure SAML providers
64+
#### [ADFS](active-directory-b2c-custom-setup-adfs2016-idp.md)
6265
#### [Salesforce](active-directory-b2c-setup-sf-app-custom.md)
6366
### Integrate RESTful APIs
6467
#### [Validate user input](active-directory-b2c-rest-api-validation-custom.md)
@@ -72,7 +75,7 @@
7275
#### [Collect logs using Application Insights](active-directory-b2c-troubleshoot-custom.md)
7376
## Reference
7477
### [Release notes](active-directory-b2c-developer-notes-custom.md)
75-
78+
### [Trust Framework definition](active-directory-b2c-reference-trustframeworks-defined-ief-custom.md)
7679
# Reference
7780
## [Code samples](https://azure.microsoft.com/en-us/resources/samples/?service=active-directory-b2c)
7881
## Glossary

‎articles/active-directory-b2c/active-directory-b2c-create-custom-attributes-profile-edit-custom.md

Lines changed: 30 additions & 47 deletions
Large diffs are not rendered by default.

‎articles/active-directory-b2c/active-directory-b2c-custom-setup-adfs2016-idp.md

Lines changed: 225 additions & 0 deletions
Large diffs are not rendered by default.

‎articles/active-directory-b2c/active-directory-b2c-custom-setup-goog-idp.md

Lines changed: 251 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,251 @@
1+
---
2+
title: 'Azure Active Directory B2C: Add Google+ as an OAuth2 identity provider using custom policies'
3+
description: Sample using Google+ as identity provider using OAuth2 protocol
4+
services: active-directory-b2c
5+
documentationcenter: ''
6+
author: yoelhor
7+
manager: joroja
8+
editor:
9+
10+
ms.assetid:
11+
ms.service: active-directory-b2c
12+
ms.workload: identity
13+
ms.tgt_pltfrm: na
14+
ms.topic: article
15+
ms.devlang: na
16+
ms.date: 08/04/2017
17+
ms.author: yoelh
18+
---
19+
20+
# Azure Active Directory B2C: Add Google+ as an OAuth2 identity provider using custom policies
21+
22+
[!INCLUDE [active-directory-b2c-advanced-audience-warning](../../includes/active-directory-b2c-advanced-audience-warning.md)]
23+
24+
This guide shows you how to enable sign-in for users from Google+ account through the use of [custom policies](active-directory-b2c-overview-custom.md).
25+
26+
## Prerequisites
27+
28+
Complete the steps in the [Getting started with custom policies](active-directory-b2c-get-started-custom.md) article.
29+
30+
These steps include:
31+
32+
1. Creating a Google+ account application.
33+
2. Adding the Google+ account application key to Azure AD B2C
34+
3. Adding claims provider to a policy
35+
4. Registering the Google+ account claims provider to a user journey
36+
5. Uploading the policy to an Azure AD B2C tenant and test it
37+
38+
## Create a Google+ account application
39+
To use Google+ as an identity provider in Azure Active Directory (Azure AD) B2C, you need to create a Google+ application and supply it with the right parameters. You can register a Google+ application here: [https://accounts.google.com/SignUp](https://accounts.google.com/SignUp)
40+
41+
1. Go to the [Google Developers Console](https://console.developers.google.com/) and sign in with your Google+ account credentials.
42+
2. Click **Create project**, enter a **Project name**, and then click **Create**.
43+
44+
3. Click on the **Projects menu**.
45+
46+
![Google+ account - Select project](media/active-directory-b2c-custom-setup-goog-idp/goog-add-new-app1.png)
47+
48+
4. Click on the **+** button.
49+
50+
![Google+ account - Create new project](media/active-directory-b2c-custom-setup-goog-idp//goog-add-new-app2.png)
51+
52+
5. Enter a **Project name**, and then click **Create**.
53+
54+
![Google+ account - New project](media/active-directory-b2c-custom-setup-goog-idp//goog-app-name.png)
55+
56+
6. Wait until the project is ready and click on the **Projects menu**.
57+
58+
![Google+ account - Wait until new project is ready to use](media/active-directory-b2c-custom-setup-goog-idp//goog-select-app1.png)
59+
60+
7. Click on your project name.
61+
62+
![Google+ account - Select the new project](media/active-directory-b2c-custom-setup-goog-idp//goog-select-app2.png)
63+
64+
8. Click **API Manager** and then click **Credentials** in the left navigation.
65+
9. Click the **OAuth consent screen** tab at the top.
66+
67+
![Google+ account - Set OAuth consent screen](media/active-directory-b2c-custom-setup-goog-idp/goog-add-cred.png)
68+
69+
10. Select or specify a valid **Email address**, provide a **Product name**, and click **Save**.
70+
71+
![Google+ - Application credentials](media/active-directory-b2c-custom-setup-goog-idp/goog-consent-screen.png)
72+
73+
11. Click **New credentials** and then choose **OAuth client ID**.
74+
75+
![Google+ - Create new application credentials](media/active-directory-b2c-custom-setup-goog-idp/goog-add-oauth2-client-id.png)
76+
77+
12. Under **Application type**, select **Web application**.
78+
79+
![Google+ - Select application type](media/active-directory-b2c-custom-setup-goog-idp/goog-web-app.png)
80+
81+
13. Provide a **Name** for your application, enter `https://login.microsoftonline.com` in the **Authorized JavaScript origins** field, and `https://login.microsoftonline.com/te/{tenant}/oauth2/authresp` in the **Authorized redirect URIs** field. Replace **{tenant}** with your tenant's name (for example, contosob2c.onmicrosoft.com). The **{tenant}** value is case-sensitive. Click **Create**.
82+
83+
![Google+ - Provide Authorized JavaScript origins and redirect URIs](media/active-directory-b2c-custom-setup-goog-idp/goog-create-client-id.png)
84+
85+
14. Copy the values of **Client Id** and **Client secret**. You need both to configure Google+ as an identity provider in your tenant. **Client secret** is an important security credential.
86+
87+
![Google+ - Copy the values of client Id and Client secret](media/active-directory-b2c-custom-setup-goog-idp/goog-client-secret.png)
88+
89+
## Add the Google+ account application key to Azure AD B2C
90+
Federation with Google+ accounts requires a client secret for Google+ account to trust Azure AD B2C on behalf of the application. You need to store your Google+ application secret in Azure AD B2C tenant:
91+
92+
1. Go to your Azure AD B2C tenant, and select **B2C Settings** > **Identity Experience Framework**
93+
2. Select **Policy Keys** to view the keys available in your tenant.
94+
3. Click **+Add**.
95+
4. For **Options**, use **Manual**.
96+
5. For **Name**, use `GoogleSecret`.
97+
The prefix `B2C_1A_` might be added automatically.
98+
6. In the **Secret** box, enter your Microsoft application secret from https://apps.dev.microsoft.com
99+
7. For **Key usage**, use **Signature**.
100+
8. Click **Create**
101+
9. Confirm that you've created the key `B2C_1A_GoogleSecret`.
102+
103+
## Add a claims provider in your extension policy
104+
105+
If you want users to sign in by using Google+ account, you need to define Google+ account as a claims provider. In other words, you need to specify an endpoint that Azure AD B2C communicates with. The endpoint provides a set of claims that are used by Azure AD B2C to verify that a specific user has authenticated.
106+
107+
Define Google+ Account as a claims provider, by adding `<ClaimsProvider>` node in your extension policy file:
108+
109+
1. Open the extension policy file (TrustFrameworkExtensions.xml) from your working directory. If you need an XML editor, [try Visual Studio Code](https://code.visualstudio.com/download), a lightweight cross-platform editor.
110+
2. Find the `<ClaimsProviders>` section
111+
3. Add the following XML snippet under the `ClaimsProviders` element and replace `client_id` value with your Google+ account application client ID before saving the file.
112+
113+
```xml
114+
<ClaimsProvider>
115+
<Domain>google.com</Domain>
116+
<DisplayName>Google</DisplayName>
117+
<TechnicalProfiles>
118+
<TechnicalProfile Id="Google-OAUTH">
119+
<DisplayName>Google</DisplayName>
120+
<Protocol Name="OAuth2" />
121+
<Metadata>
122+
<Item Key="ProviderName">google</Item>
123+
<Item Key="authorization_endpoint">https://accounts.google.com/o/oauth2/auth</Item>
124+
<Item Key="AccessTokenEndpoint">https://accounts.google.com/o/oauth2/token</Item>
125+
<Item Key="ClaimsEndpoint">https://www.googleapis.com/oauth2/v1/userinfo</Item>
126+
<Item Key="scope">email</Item>
127+
<Item Key="HttpBinding">POST</Item>
128+
<Item Key="UsePolicyInRedirectUri">0</Item>
129+
<Item Key="client_id">Your Google+ application ID</Item>
130+
</Metadata>
131+
<CryptographicKeys>
132+
<Key Id="client_secret" StorageReferenceId="B2C_1A_GoogleSecret" />
133+
</CryptographicKeys>
134+
<OutputClaims>
135+
<OutputClaim ClaimTypeReferenceId="socialIdpUserId" PartnerClaimType="id" />
136+
<OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
137+
<OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
138+
<OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="family_name" />
139+
<OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
140+
<OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="google.com" />
141+
<OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" />
142+
</OutputClaims>
143+
<OutputClaimsTransformations>
144+
<OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
145+
<OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
146+
<OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
147+
<OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
148+
</OutputClaimsTransformations>
149+
<UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
150+
<ErrorHandlers>
151+
<ErrorHandler>
152+
<ErrorResponseFormat>json</ErrorResponseFormat>
153+
<ResponseMatch>$[?(@@.error == 'invalid_grant')]</ResponseMatch>
154+
<Action>Reauthenticate</Action>
155+
<!--In case of authorization code used error, we don't want the user to select his account again.-->
156+
<!--AdditionalRequestParameters Key="prompt">select_account</AdditionalRequestParameters-->
157+
</ErrorHandler>
158+
</ErrorHandlers>
159+
</TechnicalProfile>
160+
</TechnicalProfiles>
161+
</ClaimsProvider>
162+
```
163+
164+
## Register the Google+ account claims provider to Sign up or Sign in user journey
165+
166+
The identity provider has been set up. However, it is not available in any of the sign-up/sign-in screens. Add the Google+ account identity provider to your user `SignUpOrSignIn` user journey. To make it available, we create a duplicate of an existing template user journey. Then we add the Google+ account identity provider:
167+
168+
>[!NOTE]
169+
>
170+
>If you copied the `<UserJourneys>` element from base file of your policy to the extension file (TrustFrameworkExtensions.xml), you can skip to this section.
171+
172+
1. Open the base file of your policy (for example, TrustFrameworkBase.xml).
173+
2. Find the `<UserJourneys>` element and copy the entire content of `<UserJourneys>` node.
174+
3. Open the extension file (for example, TrustFrameworkExtensions.xml) and find the `<UserJourneys>` element. If the element doesn't exist, add one.
175+
4. Paste the entire content of `<UserJournesy>` node that you copied as a child of the `<UserJourneys>` element.
176+
177+
### Display the button
178+
The `<ClaimsProviderSelections>` element defines the list of claims provider selection options and their order. `<ClaimsProviderSelection>` element is analogous to an identity provider button on a sign-up/sign-in page. If you add a `<ClaimsProviderSelection>` element for Google+ account, a new button shows up when a user lands on the page. To add this element:
179+
180+
1. Find the `<UserJourney>` node that includes `Id="SignUpOrSignIn"` in the user journey that you copied.
181+
2. Locate the `<OrchestrationStep>` node that includes `Order="1"`
182+
3. Add following XML snippet under `<ClaimsProviderSelections>` node:
183+
184+
```xml
185+
<ClaimsProviderSelection TargetClaimsExchangeId="GoogleExchange" />
186+
```
187+
188+
### Link the button to an action
189+
Now that you have a button in place, you need to link it to an action. The action, in this case, is for Azure AD B2C to communicate with Google+ account to receive a token.
190+
191+
1. Find the `<OrchestrationStep>` that includes `Order="2"` in the `<UserJourney>` node.
192+
2. Add following XML snippet under `<ClaimsExchanges>` node:
193+
194+
```xml
195+
<ClaimsExchange Id="GoogleExchange" TechnicalProfileReferenceId="Google-OAUTH" />
196+
```
197+
198+
>[!NOTE]
199+
>
200+
> * Ensure the `Id` has the same value as that of `TargetClaimsExchangeId` in the preceding section
201+
> * Ensure `TechnicalProfileReferenceId` ID is set to the technical profile you created earlier (Google-OAUTH).
202+
203+
## Upload the policy to your tenant
204+
1. In the [Azure portal](https://portal.azure.com), switch into the [context of your Azure AD B2C tenant](active-directory-b2c-navigate-to-b2c-context.md), and open the **Azure AD B2C** blade.
205+
2. Select **Identity Experience Framework**.
206+
3. Open the **All Policies** blade.
207+
4. Select **Upload Policy**.
208+
5. Check **Overwrite the policy if it exists** box.
209+
6. **Upload** TrustFrameworkExtensions.xml and ensure that it does not fail the validation
210+
211+
## Test the custom policy by using Run Now
212+
1. Open **Azure AD B2C Settings** and go to **Identity Experience Framework**.
213+
214+
>[!NOTE]
215+
>
216+
> **Run now** requires at least one application to be preregistered on the tenant.
217+
> To learn how to register applications, see the Azure AD B2C [Get started](active-directory-b2c-get-started.md) article or the [Application registration](active-directory-b2c-app-registration.md) article.
218+
219+
220+
2. Open **B2C_1A_signup_signin**, the relying party (RP) custom policy that you uploaded. Select **Run now**.
221+
3. You should be able to sign in using Google+ account.
222+
223+
## [Optional] Register the Google+ account claims provider to Profile-Edit user journey
224+
You may want to add the Google+ account identity provider also to your user `ProfileEdit` user journey. To make it available, we repeat the last two steps:
225+
226+
### Display the button
227+
1. Open the extension file of your policy (for example, TrustFrameworkExtensions.xml).
228+
2. Find the `<UserJourney>` node that includes `Id="ProfileEdit"` in the user journey that you copied.
229+
3. Locate the `<OrchestrationStep>` node that includes `Order="1"`
230+
4. Add following XML snippet under `<ClaimsProviderSelections>` node:
231+
232+
```xml
233+
<ClaimsProviderSelection TargetClaimsExchangeId="GoogleExchange" />
234+
```
235+
236+
### Link the button to an action
237+
1. Find the `<OrchestrationStep>` that includes `Order="2"` in the `<UserJourney>` node.
238+
2. Add following XML snippet under `<ClaimsExchanges>` node:
239+
240+
```xml
241+
<ClaimsExchange Id="GoogleExchange" TechnicalProfileReferenceId="Google-OAUTH" />
242+
```
243+
244+
### Test the custom Profile-Edit policy by using Run Now
245+
246+
1. Open **Azure AD B2C Settings** and go to **Identity Experience Framework**.
247+
2. Open **B2C_1A_ProfileEdit**, the relying party (RP) custom policy that you uploaded. Select **Run now**.
248+
3. You should be able to sign in using Google+ account.
249+
250+
## Download the complete policy files
251+
Optional: We recommend you build your scenario using your own Custom policy files after completing the Getting Started with Custom Policies walk through instead of using these sample files. [Sample policy files for reference](https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/tree/master/scenarios/aadb2c-ief-setup-goog-app)

0 commit comments

Comments
 (0)