You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Now that the web API is registered and you've defined its scopes, configure the web API code to work with your Azure AD B2C tenant. Open the *3-Authorization-II/2-call-api-b2c/API* folder with Visual Studio Code.
168
168
169
169
170
-
In the sample folder, open the *config.json* file. This file contains information about your Azure AD B2C identity provider. The web API app uses this information to validate the access token that the web app passes as a bearer token. Update the following properties of the app settings:
170
+
In the sample folder, open the *authConfig.js* file. This file contains information about your Azure AD B2C identity provider. The web API app uses this information to validate the access token that the web app passes as a bearer token. Update the following properties of the app settings:
171
171
172
172
|Section |Key |Value |
173
173
|---------|---------|---------|
174
174
|credentials|tenantName| Your Azure AD B2C [domain/tenant name](tenant-management.md#get-your-tenant-name). For example: `contoso.ommicrosoft.com`.|
175
175
|credentials|clientID| The web API application ID from step [2.1](#21-register-the-web-api-application). In the [earlier diagram](#app-registration), it's the application with **App ID: 2**.|
176
-
|credentials| issuer| (Optional) The token issuer `iss` claim value. Azure AD B2C by default returns the token in the following format: `https://<your-tenant-name>.b2clogin.com/<your-tenant-ID>/v2.0/`. Replace `<your-tenant-name>` with the first part of your Azure AD B2C [tenant name](tenant-management.md#get-your-tenant-name). Replace `<your-tenant-ID>` with your [Azure AD B2C tenant ID](tenant-management.md#get-your-tenant-id). |
177
176
|policies|policyName|The user flow or custom policy that you created in [step 1](#step-1-configure-your-user-flow). If your application uses multiple user flows or custom policies, specify only one. For example, use the sign-up or sign-in user flow.|
178
177
| protectedRoutes| scopes | The scopes of your web API application registration from [step 2.5](#25-grant-permissions). |
179
178
@@ -184,7 +183,6 @@ Your final configuration file should look like the following JSON:
@@ -208,4 +207,4 @@ If the sign-in process is successful, your browser is redirected to `https://jwt
208
207
- Learn how to [pass the Azure AD token to your application](idp-pass-through-user-flow.md).
209
208
- Check out the Azure AD multi-tenant federation [Live demo](https://github.com/azure-ad-b2c/unit-tests/tree/main/Identity-providers#azure-active-directory), and how to pass Azure AD access token [Live demo](https://github.com/azure-ad-b2c/unit-tests/tree/main/Identity-providers#azure-active-directory-with-access-token)
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/relyingparty.md
+3-2Lines changed: 3 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ manager: CelesteDG
8
8
ms.service: active-directory
9
9
ms.workload: identity
10
10
ms.topic: reference
11
-
ms.date: 06/26/2022
11
+
ms.date: 11/17/2022
12
12
ms.custom: project-no-code
13
13
ms.author: kengaderdus
14
14
ms.subservice: B2C
@@ -144,7 +144,8 @@ The **UserJourneyBehaviors** element contains the following elements:
144
144
| JourneyFraming | 0:1| Allows the user interface of this policy to be loaded in an iframe. |
145
145
| ScriptExecution| 0:1| The supported [JavaScript](javascript-and-page-layout.md) execution modes. Possible values: `Allow` or `Disallow` (default).
146
146
147
-
147
+
When you use the above elements, you need add them to your **UserJourneyBehaviors** element in the order specified in the table. For example, the **JourneyInsights** element must be added before (above) the **ScriptExecution** element.
148
+
148
149
### SingleSignOn
149
150
150
151
The **SingleSignOn** element contains the following attributes:
@@ -191,7 +191,7 @@ The MFA Server Migration utility targets a single Azure AD group for all migrati
191
191
192
192
To begin the migration process, enter the name or GUID of the Azure AD group you want to migrate. Once complete, press Tab or click outside the window and the utility will begin searching for the appropriate group. The window will populate all users in the group. A large group can take several minutes to finish.
193
193
194
-
To view user attribute data for a user, highlight the user, and select **View**:
194
+
To view attribute data for a user, highlight the user, and select **View**:
195
195
196
196
:::image type="content" border="true" source="./media/how-to-mfa-server-migration-utility/view-user.png" alt-text="Screenshot of how to view use settings.":::
197
197
@@ -202,7 +202,10 @@ The settings option allows you to change the settings for the migration process:
202
202
:::image type="content" border="true" source="./media/how-to-mfa-server-migration-utility/settings.png" alt-text="Screenshot of settings.":::
203
203
204
204
- Migrate – This setting allows you to specify which method(s) should be migrated for the selection of users
205
-
- User Match – Allows you to specify a different on-premises Active Directory attribute for matching Azure AD UPN instead of the default match to userPrincipalName
205
+
- User Match – Allows you to specify a different on-premises Active Directory attribute for matching Azure AD UPN instead of the default match to userPrincipalName:
206
+
- The migration utility tries direct matching to UPN before using the on-premises Active Directory attribute.
207
+
- If no match is found, it calls a Windows API to find the Azure AD UPN and get the SID, which it uses to search the MFA Server user list.
208
+
- If the Windows API doesn’t find the user or the SID isn’t found in the MFA Server, then it will use the configured Active Directory attribute to find the user in the on-premises Active Directory, and then use the SID to search the MFA Server user list.
206
209
- Automatic synchronization – Starts a background service that will continually monitor any authentication method changes to users in the on-premises MFA Server, and write them to Azure AD at the specified time interval defined
207
210
208
211
The migration process can be an automatic process, or a manual process.
Set the **Staged Rollout for Azure MFA** to **Off**. Users will once again be redirected to your on-premises federation server for MFA.
373
+
Users will no longer be redirected to your on-premises federation server for MFA, whether they’re targeted by the Staged Rollout tool or not. Note this can take up to 24 hours to take effect.
371
374
372
375
>[!NOTE]
373
376
>The update of the domain federation setting can take up to 24 hours to take effect.
@@ -443,7 +446,8 @@ If the upgrade had issues, follow these steps to roll back:
443
446
}
444
447
```
445
448
446
-
Users will no longer be redirected to your on-premises federation server for MFA, whether they’re targeted by the Staged Rollout tool or not. Note this can take up to 24 hours to take effect.
449
+
450
+
Set the **Staged Rollout for Azure MFA** to **Off**. Users will once again be redirected to your on-premises federation server for MFA.
Copy file name to clipboardExpand all lines: articles/active-directory/develop/v2-oauth2-device-code.md
+17-17Lines changed: 17 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,29 +9,31 @@ ms.service: active-directory
9
9
ms.subservice: develop
10
10
ms.workload: identity
11
11
ms.topic: conceptual
12
-
ms.date: 06/25/2021
12
+
ms.date: 11/15/2022
13
13
ms.author: ludwignick
14
14
ms.reviewer: marsma
15
-
ms.custom: aaddev
15
+
ms.custom: aaddev, engagement-fy23
16
16
---
17
17
18
18
# Microsoft identity platform and the OAuth 2.0 device authorization grant flow
19
19
20
-
The Microsoft identity platform supports the [device authorization grant](https://tools.ietf.org/html/rfc8628), which allows users to sign in to input-constrained devices such as a smart TV, IoT device, or printer. To enable this flow, the device has the user visit a webpage in their browser on another device to sign in. Once the user signs in, the device is able to get access tokens and refresh tokens as needed.
20
+
The Microsoft identity platform supports the [device authorization grant](https://tools.ietf.org/html/rfc8628), which allows users to sign in to input-constrained devices such as a smart TV, IoT device, or a printer. To enable this flow, the device has the user visit a webpage in a browser on another device to sign in. Once the user signs in, the device is able to get access tokens and refresh tokens as needed.
21
21
22
-
This article describes how to program directly against the protocol in your application. When possible, we recommend you use the supported Microsoft Authentication Libraries (MSAL) instead to [acquire tokens and call secured web APIs](authentication-flows-app-scenarios.md#scenarios-and-supported-authentication-flows). Also take a look at the [sample apps that use MSAL](sample-v2-code.md).
22
+
This article describes how to program directly against the protocol in your application. When possible, we recommend you use the supported Microsoft Authentication Libraries (MSAL) instead to [acquire tokens and call secured web APIs](authentication-flows-app-scenarios.md#scenarios-and-supported-authentication-flows). You can refer to [sample apps that use MSAL](sample-v2-code.md) for examples.
The client must first check with the authentication server for a device and user code that's used to initiate authentication. The client collects this request from the `/devicecode` endpoint. In this request, the client should also include the permissions it needs to acquire from the user. From the moment this request is sent, the user has only 15 minutes to sign in (the usual value for `expires_in`), so only make this request when the user has indicated they're ready to sign in.
34
+
The client must first check with the authentication server for a device and user code that's used to initiate authentication. The client collects this request from the `/devicecode` endpoint. In the request, the client should also include the permissions it needs to acquire from the user.
35
+
36
+
From the moment the request is sent, the user has 15 minutes to sign in. This is the default value for `expires_in`. The request should only be made when the user has indicated they're ready to sign in.
|`tenant`| Required | Can be /common, /consumers, or /organizations. It can also be the directory tenant that you want to request permission from in GUID or friendly name format. |
51
+
|`tenant`| Required | Can be `/common`, `/consumers`, or `/organizations`. It can also be the directory tenant that you want to request permission from in GUID or friendly name format. |
50
52
|`client_id`| Required | The **Application (client) ID** that the [Azure portal – App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) experience assigned to your app. |
51
53
|`scope`| Required | A space-separated list of [scopes](v2-permissions-and-consent.md) that you want the user to consent to. |
52
54
@@ -68,19 +70,17 @@ A successful response will be a JSON object containing the required information
68
70
69
71
## Authenticating the user
70
72
71
-
After receiving the `user_code` and `verification_uri`, the client displays these to the user, instructing them to sign in using their mobile phone or PC browser.
73
+
After receiving the `user_code` and `verification_uri`, the client displays these to the user, instructing them to use their mobile phone or PC browser to sign in.
72
74
73
-
If the user authenticates with a personal account (on /common or /consumers), they will be asked to sign in again in order to transfer authentication state to the device. They will also be asked to provide consent, to ensure they are aware of the permissions being granted. This does not apply to work or school accounts used to authenticate.
75
+
If the user authenticates with a personal account, using `/common` or `/consumers`, they'll be asked to sign in again in order to transfer authentication state to the device. This is because the device is unable to access the user's cookies. They'll also be asked to consent to the permissions requested by the client. This however doesn't apply to work or school accounts used to authenticate.
74
76
75
77
While the user is authenticating at the `verification_uri`, the client should be polling the `/token` endpoint for the requested token using the `device_code`.
76
78
77
79
```HTTP
78
80
POST https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
The device code flow is a polling protocol so your client must expect to receive errors before the user has finished authenticating.
95
+
The device code flow is a polling protocol so errors served to the client must be expected prior to completion of user authentication.
96
96
97
97
| Error | Description | Client Action |
98
98
| ------ | ----------- | -------------|
99
99
|`authorization_pending`| The user hasn't finished authenticating, but hasn't canceled the flow. | Repeat the request after at least `interval` seconds. |
100
-
|`authorization_declined`| The end user denied the authorization request.| Stop polling, and revert to an unauthenticated state. |
100
+
|`authorization_declined`| The end user denied the authorization request.| Stop polling and revert to an unauthenticated state. |
101
101
|`bad_verification_code`| The `device_code` sent to the `/token` endpoint wasn't recognized. | Verify that the client is sending the correct `device_code` in the request. |
102
-
|`expired_token`|At least`expires_in`seconds have passed, and authentication is no longer possible with this`device_code`. | Stop polling and revert to an unauthenticated state. |
102
+
|`expired_token`|Value of`expires_in`has been exceeded and authentication is no longer possible with `device_code`. | Stop polling and revert to an unauthenticated state. |
103
103
104
104
### Successful authentication response
105
105
@@ -119,8 +119,8 @@ A successful token response will look like:
119
119
| Parameter | Format | Description |
120
120
| --------- | ------ | ----------- |
121
121
|`token_type`| String| Always `Bearer`. |
122
-
|`scope`| Space separated strings | If an access token was returned, this lists the scopes the access token is valid for. |
123
-
|`expires_in`| int | Number of seconds before the included access token is valid for. |
122
+
|`scope`| Space separated strings | If an access token was returned, this lists the scopes in which the access token is valid for. |
123
+
|`expires_in`| int | Number of seconds the included access token is valid for. |
124
124
|`access_token`| Opaque string | Issued for the [scopes](v2-permissions-and-consent.md) that were requested. |
125
125
|`id_token`| JWT | Issued if the original `scope` parameter included the `openid` scope. |
126
126
|`refresh_token`| Opaque string | Issued if the original `scope` parameter included `offline_access`. |
0 commit comments