Skip to content

Commit 7d3ec6c

Browse files
ktoliverktoliver
authored
Merge pull request #106887 from yoelhor/patch-11
Update connect-with-saml-service-providers.md
2 parents 19df117 + fc39288 commit 7d3ec6c

File tree

4 files changed

+88
-6
lines changed

4 files changed

+88
-6
lines changed

‎articles/active-directory-b2c/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -329,6 +329,8 @@
329329
href: restful-technical-profile.md
330330
- name: SAML
331331
href: saml-technical-profile.md
332+
- name: SAML token issuer
333+
href: saml-issuer-technical-profile.md
332334
- name: Self-asserted
333335
href: self-asserted-technical-profile.md
334336
- name: SSO session

‎articles/active-directory-b2c/connect-with-saml-service-providers.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ Next, upload the SAML assertion and response signing certificate to Azure AD B2C
109109
110110
### 2.1 Create the SAML token issuer
111111
112-
Now, add the capability for your tenant to issue SAML tokens.
112+
Now, add the capability for your tenant to issue SAML tokens, using [SAML token issuer](saml-issuer-technical-profile.md) and [SAML session provider](custom-policy-reference-sso.md#samlssosessionprovider) technical profiles.
113113
114114
Open `SocialAndLocalAccounts\`**`TrustFrameworkExtensions.xml`** in the custom policy starter pack.
115115
@@ -293,7 +293,7 @@ The metadata is information used in the SAML protocol to expose the configuratio
293293

294294
If there are properties specified in *both* the SAML metadata URL and in the application registration's manifest, they are **merged**. The properties specified in the metadata URL are processed first and take precedence.
295295

296-
For this tutorial which uses the SAML test application, use the following value for `samlMetadataUrl`:
296+
For this tutorial, which uses the SAML test application, use the following value for `samlMetadataUrl`:
297297

298298
```JSON
299299
"samlMetadataUrl":"https://samltestapp2.azurewebsites.net/Metadata",
@@ -320,7 +320,7 @@ For this tutorial, in which you use the SAML test application, set the `url` pro
320320

321321
This optional property represents the `Logout` URL (`SingleLogoutService` URL in the relying party metadata), and the `BindingType` for this is assumed to be `Http-Redirect`.
322322

323-
For this tutorial which uses the SAML test application, leave `logoutUrl` set to `https://samltestapp2.azurewebsites.net/logout`:
323+
For this tutorial, which uses the SAML test application, leave `logoutUrl` set to `https://samltestapp2.azurewebsites.net/logout`:
324324

325325
```JSON
326326
"logoutUrl": "https://samltestapp2.azurewebsites.net/logout",

‎articles/active-directory-b2c/custom-policy-reference-sso.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ manager: celestedg
99
ms.service: active-directory
1010
ms.workload: identity
1111
ms.topic: reference
12-
ms.date: 03/02/2020
12+
ms.date: 03/09/2020
1313
ms.author: mimart
1414
ms.subservice: B2C
1515
---
@@ -20,7 +20,7 @@ ms.subservice: B2C
2020

2121
Single sign-on (SSO) session management in Azure Active Directory B2C (Azure AD B2C) enables an administrator to control interaction with a user after the user has already authenticated. For example, the administrator can control whether the selection of identity providers is displayed, or whether local account details need to be entered again. This article describes how to configure the SSO settings for Azure AD B2C.
2222

23-
SSO session management has two parts. The first deals with the user's interactions directly with Azure AD B2C and the other deals with the user's interactions with external parties such as Facebook. Azure AD B2C does not override or bypass SSO sessions that might be held by external parties. Rather the route through Azure AD B2C to get to the external party is “remembered”, avoiding the need to reprompt the user to select their social or enterprise identity provider. The ultimate SSO decision remains with the external party.
23+
SSO session management has two parts. The first deals with the user's interactions directly with Azure AD B2C and the other deals with the user's interactions with external parties such as Facebook. Azure AD B2C does not override or bypass SSO sessions that might be held by external parties. Rather the route through Azure AD B2C to get to the external party is "remembered", avoiding the need to reprompt the user to select their social or enterprise identity provider. The ultimate SSO decision remains with the external party.
2424

2525
SSO session management uses the same semantics as any other technical profile in custom policies. When an orchestration step is executed, the technical profile associated with the step is queried for a `UseTechnicalProfileForSessionManagement` reference. If one exists, the referenced SSO session provider is then checked to see if the user is a session participant. If so, the SSO session provider is used to repopulate the session. Similarly, when the execution of an orchestration step is complete, the provider is used to store information in the session if an SSO session provider has been specified.
2626

@@ -134,7 +134,7 @@ This provider is used for managing the Azure AD B2C SAML sessions between a rely
134134

135135
When using the provider for storing the B2C SAML session, the `RegisterServiceProviders` must set to `true`. SAML session logout requires the `SessionIndex` and `NameID` to complete.
136136

137-
The following `SM-Saml-idp` technical profile is used by [SAML issuer technical profile](connect-with-saml-service-providers.md)
137+
The following `SM-Saml-idp` technical profile is used by [SAML issuer technical profile](saml-issuer-technical-profile.md)
138138

139139
```XML
140140
<TechnicalProfile Id="SM-Saml-sp">

‎articles/active-directory-b2c/saml-issuer-technical-profile.md

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
---
2+
title: Define a technical profile for a SAML issuer in a custom policy
3+
titleSuffix: Azure AD B2C
4+
description: Define a technical profile for a Security Assertion Markup Language token (SAML) issuer in a custom policy in Azure Active Directory B2C.
5+
services: active-directory-b2c
6+
author: msmimart
7+
manager: celestedg
8+
9+
ms.service: active-directory
10+
ms.workload: identity
11+
ms.topic: reference
12+
ms.date: 03/09/2020
13+
ms.author: mimart
14+
ms.subservice: B2C
15+
---
16+
17+
# Define a technical profile for a SAML token issuer in an Azure Active Directory B2C custom policy
18+
19+
[!INCLUDE [active-directory-b2c-advanced-audience-warning](../../includes/active-directory-b2c-advanced-audience-warning.md)]
20+
21+
Azure Active Directory B2C (Azure AD B2C) emits several types of security tokens as it processes each authentication flow. A technical profile for a SAML token issuer emits a SAML token that is returned back to the relying party application (service provider). Usually this technical profile is the last orchestration step in the user journey.
22+
23+
## Protocol
24+
25+
The **Name** attribute of the **Protocol** element needs to be set to `None`. Set the **OutputTokenFormat** element to `SAML2`.
26+
27+
The following example shows a technical profile for `Saml2AssertionIssuer`:
28+
29+
```XML
30+
<TechnicalProfile Id="Saml2AssertionIssuer">
31+
<DisplayName>Token Issuer</DisplayName>
32+
<Protocol Name="None"/>
33+
<OutputTokenFormat>SAML2</OutputTokenFormat>
34+
<Metadata>
35+
<Item Key="IssuerUri">https://tenant-name.b2clogin.com/tenant-name.onmicrosoft.com/B2C_1A_signup_signin_SAML</Item>
36+
</Metadata>
37+
<CryptographicKeys>
38+
<Key Id="MetadataSigning" StorageReferenceId="B2C_1A_SamlIdpCert"/>
39+
<Key Id="SamlMessageSigning" StorageReferenceId="B2C_1A_SamlIdpCert"/>
40+
</CryptographicKeys>
41+
<InputClaims/>
42+
<OutputClaims/>
43+
<UseTechnicalProfileForSessionManagement ReferenceId="SM-Saml-sp"/>
44+
</TechnicalProfile>
45+
```
46+
47+
## Input, output, and persist claims
48+
49+
The **InputClaims**, **OutputClaims**, and **PersistClaims** elements are empty or absent. The **InutputClaimsTransformations** and **OutputClaimsTransformations** elements are also absent.
50+
51+
## Metadata
52+
53+
| Attribute | Required | Description |
54+
| --------- | -------- | ----------- |
55+
| IssuerUri | No | The issuer name that appears in the SAML response. The value should be the same name as configured in the relying party application. |
56+
57+
## Cryptographic keys
58+
59+
The CryptographicKeys element contains the following attributes:
60+
61+
| Attribute | Required | Description |
62+
| --------- | -------- | ----------- |
63+
| MetadataSigning | Yes | The X509 certificate (RSA key set) to use to sign SAML metadata. Azure AD B2C uses this key to sign the metadata. |
64+
| SamlMessageSigning| Yes| Specify the X509 certificate (RSA key set) to use to sign SAML messages. Azure AD B2C uses this key to signing the response `<samlp:Response>` send to the relying party.|
65+
66+
## Session management
67+
68+
To configure the Azure AD B2C SAML sessions between a relying party application, the attribute of the `UseTechnicalProfileForSessionManagement` element, reference to [SamlSSOSessionProvider](custom-policy-reference-sso.md#samlssosessionprovider) SSO session.
69+
70+
71+
72+
73+
74+
75+
76+
77+
78+
79+
80+

0 commit comments

Comments
 (0)