Skip to content

Commit 741acec

Browse files
ktoliverktoliver
authored
Merge branch 'master' into patch-4
2 parents 2f1fe36 + 25ab80c commit 741acec

File tree

774 files changed

+15064
-6352
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

774 files changed

+15064
-6352
lines changed

‎.openpublishing.redirection.json

Lines changed: 61 additions & 531 deletions
Large diffs are not rendered by default.

‎articles/active-directory-b2c/TOC.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -226,7 +226,9 @@
226226
- name: Tokens and session management
227227
items:
228228
- name: Customize tokens
229-
href: custom-policy-manage-sso-and-token-config.md
229+
href: configure-tokens-custom-policy.md
230+
- name: Configure session behavior
231+
href: session-behavior-custom-policy.md
230232
- name: Pass through external IdP token
231233
href: idp-pass-through-custom.md
232234
- name: Adaptive experience

‎articles/active-directory-b2c/custom-policy-manage-sso-and-token-config.md renamed to ‎articles/active-directory-b2c/configure-tokens-custom-policy.md

Lines changed: 21 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ manager: celestedg
99
ms.service: active-directory
1010
ms.workload: identity
1111
ms.topic: conceptual
12-
ms.date: 10/09/2018
12+
ms.date: 05/07/2020
1313
ms.author: mimart
1414
ms.subservice: B2C
1515
---
@@ -18,7 +18,7 @@ ms.subservice: B2C
1818

1919
This article provides information about how you can manage your token, session, and single sign-on (SSO) configurations using [custom policies](custom-policy-overview.md) in Azure Active Directory B2C (Azure AD B2C).
2020

21-
## Token lifetimes and claims configuration
21+
## JTW token lifetimes and claims configuration
2222

2323
To change the settings on your token lifetimes, you add a [ClaimsProviders](claimsproviders.md) element in the relying party file of the policy you want to impact. The **ClaimsProviders** element is a child of the [TrustFrameworkPolicy](trustframeworkpolicy.md) element.
2424

@@ -28,21 +28,21 @@ Inside, you'll need to put the information that affects your token lifetimes. Th
2828

2929
```XML
3030
<ClaimsProviders>
31-
<ClaimsProvider>
32-
<DisplayName>Token Issuer</DisplayName>
33-
<TechnicalProfiles>
34-
<TechnicalProfile Id="JwtIssuer">
35-
<Metadata>
36-
<Item Key="token_lifetime_secs">3600</Item>
37-
<Item Key="id_token_lifetime_secs">3600</Item>
38-
<Item Key="refresh_token_lifetime_secs">1209600</Item>
39-
<Item Key="rolling_refresh_token_lifetime_secs">7776000</Item>
40-
<Item Key="IssuanceClaimPattern">AuthorityAndTenantGuid</Item>
41-
<Item Key="AuthenticationContextReferenceClaimPattern">None</Item>
42-
</Metadata>
43-
</TechnicalProfile>
44-
</TechnicalProfiles>
45-
</ClaimsProvider>
31+
<ClaimsProvider>
32+
<DisplayName>Token Issuer</DisplayName>
33+
<TechnicalProfiles>
34+
<TechnicalProfile Id="JwtIssuer">
35+
<Metadata>
36+
<Item Key="token_lifetime_secs">3600</Item>
37+
<Item Key="id_token_lifetime_secs">3600</Item>
38+
<Item Key="refresh_token_lifetime_secs">1209600</Item>
39+
<Item Key="rolling_refresh_token_lifetime_secs">7776000</Item>
40+
<Item Key="IssuanceClaimPattern">AuthorityAndTenantGuid</Item>
41+
<Item Key="AuthenticationContextReferenceClaimPattern">None</Item>
42+
</Metadata>
43+
</TechnicalProfile>
44+
</TechnicalProfiles>
45+
</ClaimsProvider>
4646
</ClaimsProviders>
4747
```
4848

@@ -84,20 +84,8 @@ The following values are set in the previous example:
8484
<OutputClaim ClaimTypeReferenceId="sub" />
8585
```
8686

87-
## Session behavior and SSO
87+
## Next steps
8888

89-
To change your session behavior and SSO configurations, you add a **UserJourneyBehaviors** element inside of the [RelyingParty](relyingparty.md) element. The **UserJourneyBehaviors** element must immediately follow the **DefaultUserJourney**. The inside of your **UserJourneyBehavors** element should look like this example:
90-
91-
```XML
92-
<UserJourneyBehaviors>
93-
<SingleSignOn Scope="Application" />
94-
<SessionExpiryType>Absolute</SessionExpiryType>
95-
<SessionExpiryInSeconds>86400</SessionExpiryInSeconds>
96-
</UserJourneyBehaviors>
97-
```
98-
99-
The following values are configured in the previous example:
100-
101-
- **Single sign on (SSO)** - Single sign-on is configured with the **SingleSignOn**. The applicable values are `Tenant`, `Application`, `Policy`, and `Suppressed`.
102-
- **Web app session time-out** - The web app session timeout is set with the **SessionExpiryType** element. The applicable values are `Absolute` and `Rolling`.
103-
- **Web app session lifetime** - The web app session lifetime is set with the **SessionExpiryInSeconds** element. The default value is 86400 seconds (1440 minutes).
89+
- Learn more about [Azure AD B2C session](session-overview.md).
90+
- Learn how to [configure session behavior in custom policies](session-behavior-custom-policy.md).
91+
- Reference: [JwtIssuer](jwt-issuer-technical-profile.md).

‎articles/active-directory-b2c/configure-tokens.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ manager: celestedg
88
ms.service: active-directory
99
ms.workload: identity
1010
ms.topic: conceptual
11-
ms.date: 04/16/2019
11+
ms.date: 05/07/2020
1212
ms.author: mimart
1313
ms.subservice: B2C
1414
---
@@ -21,7 +21,7 @@ In this article, you learn how to configure the [lifetime and compatibility of a
2121

2222
[Create a user flow](tutorial-create-user-flows.md) to enable users to sign up and sign in to your application.
2323

24-
## Configure token lifetime
24+
## Configure JWT token lifetime
2525

2626
You can configure the token lifetime on any user flow.
2727

@@ -37,7 +37,7 @@ You can configure the token lifetime on any user flow.
3737

3838
8. Click **Save**.
3939

40-
## Configure token compatibility
40+
## Configure JWT token compatibility
4141

4242
1. Select **User flows (policies)**.
4343
2. Open the user flow that you previously created.

‎articles/active-directory-b2c/custom-policy-reference-sso.md

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ manager: celestedg
99
ms.service: active-directory
1010
ms.workload: identity
1111
ms.topic: reference
12-
ms.date: 04/28/2020
12+
ms.date: 05/07/2020
1313
ms.author: mimart
1414
ms.subservice: B2C
1515
---
@@ -18,9 +18,7 @@ ms.subservice: B2C
1818

1919
[!INCLUDE [active-directory-b2c-advanced-audience-warning](../../includes/active-directory-b2c-advanced-audience-warning.md)]
2020

21-
[Single sign-on (SSO) session](session-overview.md) management in Azure Active Directory B2C (Azure AD B2C) enables an administrator to control interaction with a user after the user has already authenticated. For example, the administrator can control whether the selection of identity providers is displayed, or whether account details need to be entered again. This article describes how to configure the SSO settings for Azure AD B2C.
22-
23-
SSO session management uses the same semantics as any other technical profile in custom policies. When an orchestration step is executed, the technical profile associated with the step is queried for a `UseTechnicalProfileForSessionManagement` reference. If one exists, the referenced SSO session provider is then checked to see if the user is a session participant. If so, the SSO session provider is used to repopulate the session. Similarly, when the execution of an orchestration step is complete, the provider is used to store information in the session if an SSO session provider has been specified.
21+
[Single sign-on (SSO) session](session-overview.md) management uses the same semantics as any other technical profile in custom policies. When an orchestration step is executed, the technical profile associated with the step is queried for a `UseTechnicalProfileForSessionManagement` reference. If one exists, the referenced SSO session provider is then checked to see if the user is a session participant. If so, the SSO session provider is used to repopulate the session. Similarly, when the execution of an orchestration step is complete, the provider is used to store information in the session if an SSO session provider has been specified.
2422

2523
Azure AD B2C has defined a number of SSO session providers that can be used:
2624

@@ -170,3 +168,4 @@ The following `SM-Saml-issuer` technical profile is used by [SAML issuer technic
170168
## Next steps
171169

172170
- Learn more about [Azure AD B2C session](session-overview.md).
171+
- Learn how to [configure session behavior in custom policies](session-behavior-custom-policy.md).

‎articles/active-directory-b2c/jwt-issuer-technical-profile.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ manager: celestedg
99
ms.service: active-directory
1010
ms.workload: identity
1111
ms.topic: reference
12-
ms.date: 04/28/2020
12+
ms.date: 05/07/2020
1313
ms.author: mimart
1414
ms.subservice: B2C
1515
---
@@ -29,7 +29,7 @@ The following example shows a technical profile for `JwtIssuer`:
2929
```XML
3030
<TechnicalProfile Id="JwtIssuer">
3131
<DisplayName>JWT Issuer</DisplayName>
32-
<Protocol Name="None" />
32+
<Protocol Name="OpenIdConnect" />
3333
<OutputTokenFormat>JWT</OutputTokenFormat>
3434
<Metadata>
3535
<Item Key="client_id">{service:te}</Item>

‎articles/active-directory-b2c/session-behavior-custom-policy.md

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
---
2+
title: Configure session behavior using custom policies - Azure Active Directory B2C | Microsoft Docs
3+
description: Configure session behavior using custom policies in Azure Active Directory B2C.
4+
services: active-directory-b2c
5+
author: msmimart
6+
manager: celestedg
7+
8+
ms.service: active-directory
9+
ms.workload: identity
10+
ms.topic: conceptual
11+
ms.date: 05/07/2020
12+
ms.author: mimart
13+
ms.subservice: B2C
14+
---
15+
16+
# Configure session behavior using custom policies in Azure Active Directory B2C
17+
18+
[Single sign-on (SSO) session](session-overview.md) management in Azure Active Directory B2C (Azure AD B2C) enables an administrator to control interaction with a user after the user has already authenticated. For example, the administrator can control whether the selection of identity providers is displayed, or whether account details need to be entered again. This article describes how to configure the SSO settings for Azure AD B2C.
19+
20+
## Session behavior properties
21+
22+
You can use the following properties to manage web application sessions:
23+
24+
- **Web app session lifetime (minutes)** - The lifetime of Azure AD B2C's session cookie stored on the user's browser upon successful authentication.
25+
- Default = 86400 seconds (1440 minutes).
26+
- Minimum (inclusive) = 900 seconds (15 minutes).
27+
- Maximum (inclusive) = 86400 seconds (1440 minutes).
28+
- **Web app session timeout** - The [session expiry type](session-overview.md#session-expiry-type), *Rolling*, or *Absolute*.
29+
- **Single sign-on configuration** - The [session scope](session-overview.md#session-scope) of the single sign-on (SSO) behavior across multiple apps and user flows in your Azure AD B2C tenant.
30+
31+
## Configure the properties
32+
33+
To change your session behavior and SSO configurations, you add a **UserJourneyBehaviors** element inside of the [RelyingParty](relyingparty.md) element. The **UserJourneyBehaviors** element must immediately follow the **DefaultUserJourney**. Your **UserJourneyBehavors** element should look like this example:
34+
35+
```XML
36+
<UserJourneyBehaviors>
37+
<SingleSignOn Scope="Application" />
38+
<SessionExpiryType>Absolute</SessionExpiryType>
39+
<SessionExpiryInSeconds>86400</SessionExpiryInSeconds>
40+
</UserJourneyBehaviors>
41+
```
42+
43+
## Single sign-out
44+
45+
### Configure the applications
46+
47+
When you redirect the user to the Azure AD B2C sign-out endpoint (for both OAuth2 and SAML protocols), Azure AD B2C clears the user's session from the browser. To allow [Single sign-out](session-overview.md#single-sign-out), set the `LogoutUrl` of the application from the Azure portal:
48+
49+
1. Navigate to the [Azure portal](https://portal.azure.com).
50+
1. Choose your Azure AD B2C directory by clicking your account in the top right corner of the page.
51+
1. In the left menu, choose **Azure AD B2C**, select **App registrations**, and then select your application.
52+
1. Select **Settings**, select **Properties**, and then find the **Logout URL** text box.
53+
54+
### Configure the token issuer
55+
56+
To support single sign-out, the token issuer technical profiles for both JWT and SAML must specify:
57+
58+
- The protocol name, such as `<Protocol Name="OpenIdConnect" />`
59+
- The reference to the session technical profile, such as `UseTechnicalProfileForSessionManagement ReferenceId="SM-jwt-issuer" />`.
60+
61+
The following example illustrates the JWT and SAML token issuers with single sign-out:
62+
63+
```xml
64+
<ClaimsProvider>
65+
<DisplayName>Local Account SignIn</DisplayName>
66+
<TechnicalProfiles>
67+
<!-- JWT Token Issuer -->
68+
<TechnicalProfile Id="JwtIssuer">
69+
<DisplayName>JWT token Issuer</DisplayName>
70+
<Protocol Name="OpenIdConnect" />
71+
<OutputTokenFormat>JWT</OutputTokenFormat>
72+
...
73+
<UseTechnicalProfileForSessionManagement ReferenceId="SM-jwt-issuer" />
74+
</TechnicalProfile>
75+
76+
<!-- Session management technical profile for OIDC based tokens -->
77+
<TechnicalProfile Id="SM-OAuth-issuer">
78+
<DisplayName>Session Management Provider</DisplayName>
79+
<Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.OAuthSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
80+
</TechnicalProfile>
81+
82+
<!--SAML token issuer-->
83+
<TechnicalProfile Id="Saml2AssertionIssuer">
84+
<DisplayName>SAML token issuer</DisplayName>
85+
<Protocol Name="SAML2" />
86+
<OutputTokenFormat>SAML2</OutputTokenFormat>
87+
...
88+
<UseTechnicalProfileForSessionManagement ReferenceId="SM-Saml-issuer" />
89+
</TechnicalProfile>
90+
91+
<!-- Session management technical profile for SAML based tokens -->
92+
<TechnicalProfile Id="SM-Saml-issuer">
93+
<DisplayName>Session Management Provider</DisplayName>
94+
<Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.SamlSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
95+
</TechnicalProfile>
96+
</TechnicalProfiles>
97+
</ClaimsProvider>
98+
```
99+
100+
## Next steps
101+
102+
- Learn more about [Azure AD B2C session](session-overview.md).

‎articles/active-directory-b2c/session-behavior.md

Lines changed: 6 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -8,39 +8,26 @@ manager: celestedg
88
ms.service: active-directory
99
ms.workload: identity
1010
ms.topic: conceptual
11-
ms.date: 04/16/2019
11+
ms.date: 05/07/2020
1212
ms.author: mimart
1313
ms.subservice: B2C
1414
---
1515

1616
# Configure session behavior in Azure Active Directory B2C
1717

18-
This feature gives you fine-grained control, on a [per-user flow basis](user-flow-overview.md), of:
19-
20-
- Lifetimes of web application sessions managed by Azure AD B2C.
21-
- Single sign-on (SSO) behavior across multiple apps and user flows in your Azure AD B2C tenant.
22-
23-
These settings are not available for password reset user flows.
24-
25-
Azure AD B2C supports the [OpenID Connect authentication protocol](openid-connect.md) for enabling secure sign-in to web applications. You can use the following properties to manage web application sessions:
18+
[Single sign-on (SSO) session](session-overview.md) management in Azure Active Directory B2C (Azure AD B2C) enables an administrator to control interaction with a user after the user has already authenticated. For example, the administrator can control whether the selection of identity providers is displayed, or whether account details need to be entered again. This article describes how to configure the SSO settings for Azure AD B2C.
2619

2720
## Session behavior properties
2821

22+
You can use the following properties to manage web application sessions:
23+
2924
- **Web app session lifetime (minutes)** - The lifetime of Azure AD B2C's session cookie stored on the user's browser upon successful authentication.
3025
- Default = 1440 minutes.
3126
- Minimum (inclusive) = 15 minutes.
3227
- Maximum (inclusive) = 1440 minutes.
33-
- **Web app session timeout** - If this switch is set to **Absolute**, the user is forced to authenticate again after the time period specified by **Web app session lifetime (minutes)** elapses. If this switch is set to **Rolling** (the default setting), the user remains signed in as long as the user is continually active in your web application.
34-
- **Single sign-on configuration** If you have multiple applications and user flows in your B2C tenant, you can manage user interactions across them using the **Single sign-on configuration** property. You can set the property to one of the following settings:
35-
- **Tenant** - This setting is the default. Using this setting allows multiple applications and user flows in your B2C tenant to share the same user session. For example, once a user signs into an application, the user can also seamlessly sign into another one, Contoso Pharmacy, upon accessing it.
36-
- **Application** - This setting allows you to maintain a user session exclusively for an application, independent of other applications. For example, if you want the user to sign in to Contoso Pharmacy (with the same credentials), even if the user is already signed into Contoso Shopping, another application on the same B2C tenant.
37-
- **Policy** - This setting allows you to maintain a user session exclusively for a user flow, independent of the applications using it. For example, if the user has already signed in and completed a multi factor authentication (MFA) step, the user can be given access to higher-security parts of multiple applications as long as the session tied to the user flow doesn't expire.
38-
- **Disabled** - This setting forces the user to run through the entire user flow on every execution of the policy.
39-
40-
The following use cases are enabled using these properties:
28+
- **Web app session timeout** - The [session expiry type](session-overview.md#session-expiry-type), *Rolling*, or *Absolute*.
29+
- **Single sign-on configuration** - The [session scope](session-overview.md#session-scope) of the single sign-on (SSO) behavior across multiple apps and user flows in your Azure AD B2C tenant.
4130

42-
- Meet your industry's security and compliance requirements by setting the appropriate web application session lifetimes.
43-
- Force authentication after a set time period during a user's interaction with a high-security part of your web application.
4431

4532
## Configure the properties
4633

0 commit comments

Comments
 (0)