Skip to content

Commit 90d269b

Browse files
halkazwinihalkazwini
committed
Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into ip-del
2 parents c845fef + a1bd70e commit 90d269b

File tree

229 files changed

+3510
-991
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

229 files changed

+3510
-991
lines changed

‎articles/active-directory-b2c/TOC.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,18 @@
6666
- name: Authentication library
6767
href: ../active-directory/develop/msal-overview.md?bc=%2fazure%2factive-directory-b2c%2fbread%2ftoc.json&toc=%2fazure%2factive-directory-b2c%2fTOC.json
6868
displayName: MSAL, client library, Microsoft Authentication Library
69+
- name: Azure AD B2C global identitiy framework
70+
items:
71+
- name: Global identity solutions
72+
href: azure-ad-b2c-global-identity-solutions.md
73+
- name: Funnel-based design considerations
74+
href: azure-ad-b2c-global-identity-funnel-based-design.md
75+
- name: Region-based design considerations
76+
href: azure-ad-b2c-global-identity-region-based-design.md
77+
- name: Funnel-based proof of concept
78+
href: azure-ad-b2c-global-identity-proof-of-concept-funnel.md
79+
- name: Regional-based proof of concept
80+
href: azure-ad-b2c-global-identity-proof-of-concept-regional.md
6981
- name: Azure AD B2C best practices
7082
href: best-practices.md
7183
- name: Application types

‎articles/active-directory-b2c/azure-ad-b2c-global-identity-funnel-based-design.md

Lines changed: 317 additions & 0 deletions
Large diffs are not rendered by default.

‎articles/active-directory-b2c/azure-ad-b2c-global-identity-proof-of-concept-funnel.md

Lines changed: 187 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,187 @@
1+
---
2+
title: Azure Active Directory B2C global identity framework proof of concept for funnel-based configuration
3+
description: Learn how to create a proof of concept for funnel-based approach for Azure AD B2C to provide customer identity and access management for global customers.
4+
services: active-directory-b2c
5+
author: gargi-sinha
6+
manager: martinco
7+
8+
ms.service: active-directory
9+
ms.workload: identity
10+
ms.topic: conceptual
11+
ms.date: 12/15/2022
12+
ms.author: gasinh
13+
ms.subservice: B2C
14+
---
15+
16+
# Azure Active Directory B2C global identity framework proof of concept for funnel-based configuration
17+
18+
The following section describes how to create proof of concept implementations for funnel-based orchestration. The completed Azure Active Directory B2C (Azure AD B2C) custom policies can be found [here](https://github.com/azure-ad-b2c/samples/tree/master/policies/global-architecture-model/funnel-based-approach).
19+
20+
## Funnel-based approach
21+
22+
The following block diagram shows the proof of concept. The guidance will show how to configure the Azure AD B2C tenants. The External API layer and Geo distributed lookup table isn't included as part of this guide.
23+
24+
![Screenshot shows the funnel-based approach block diagram.](media/azure-ad-b2c-global-identity-proof-of-concept/funnel-based-block-diagram.png)
25+
26+
27+
## Funnel tenant
28+
29+
1. [Create a tenant.](../active-directory-b2c/tutorial-create-tenant.md)
30+
31+
1. [Configure federations to each Azure AD B2C tenant/policy combination](tenant-management.md)
32+
33+
1. Configure client_id mapping to region – use [lookup claim transformation](general-transformations.md) to emulate.
34+
35+
```xml
36+
<ClaimsTransformation Id="ClientIdToRegion" TransformationMethod="LookupValue">
37+
<InputClaims>
38+
<InputClaim ClaimTypeReferenceId="regionFromURL" TransformationClaimType="inputParameterId" />
39+
</InputClaims>
40+
<InputParameters>
41+
<InputParameter Id="0dd7579e-fb90-4178-bc36-77a3fe658683" DataType="string" Value="APAC" />
42+
<InputParameter Id="7e7f5403-b3d7-41cc-85fc-130ab6fd9361" DataType="string" Value="NOAM" />
43+
<InputParameter Id="4ea5d578-9c51-4091-96d1-58e15e98e9b9" DataType="string" Value="EMEA" />
44+
<InputParameter Id="errorOnFailedLookup" DataType="boolean" Value="false" />
45+
</InputParameters>
46+
<OutputClaims>
47+
<OutputClaim ClaimTypeReferenceId="sendToRegion" TransformationClaimType="outputClaim" />
48+
</OutputClaims>
49+
</ClaimsTransformation>
50+
```
51+
52+
1. Configure federations to be enabled based on client_id – region mapping.
53+
54+
```xml
55+
<TechnicalProfile Id="HRDLogic">
56+
<DisplayName>ParseDomainHint</DisplayName>
57+
<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.ClaimsTransformationProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
58+
<Metadata>
59+
<Item Key="IncludeClaimResolvingInClaimsHandling">true</Item>
60+
</Metadata>
61+
<InputClaims>
62+
<InputClaim ClaimTypeReferenceId="regionFromURL" DefaultValue="{OIDC:ClientId}" AlwaysUseDefaultValue="true" />
63+
</InputClaims>
64+
<OutputClaims>
65+
<OutputClaim ClaimTypeReferenceId="sendToRegion" />
66+
<OutputClaim ClaimTypeReferenceId="identityProviders" />
67+
</OutputClaims>
68+
<OutputClaimsTransformations>
69+
<OutputClaimsTransformation ReferenceId="ClientIdToRegion" />
70+
<OutputClaimsTransformation ReferenceId="CreateidentityProvidersCollection" />
71+
</OutputClaimsTransformations>
72+
<UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
73+
</TechnicalProfile>
74+
```
75+
76+
## Regional tenant
77+
78+
1. [Create a tenant.](../active-directory-b2c/tutorial-create-tenant.md)
79+
80+
1. [Create an application registration](../active-directory-b2c/tutorial-register-applications.md?tabs=app-reg-ga) to establish federation with funnel tenant.
81+
82+
## Sign in
83+
84+
1. Configure identifier to region lookup via global lookup table, use [lookup claim transformation](general-transformations.md) to emulate.
85+
86+
```xml
87+
<ClaimsTransformation Id="UserIdToRegion" TransformationMethod="LookupValue">
88+
<InputClaims>
89+
<InputClaim ClaimTypeReferenceId="signInName" TransformationClaimType="inputParameterId" />
90+
</InputClaims>
91+
<InputParameters>
92+
<InputParameter Id="[email protected]" DataType="string" Value="NOAM" />
93+
<InputParameter Id="[email protected]" DataType="string" Value="NOAM" />
94+
<InputParameter Id="[email protected]" DataType="string" Value="EMEA" />
95+
<InputParameter Id="[email protected]" DataType="string" Value="EMEA" />
96+
<InputParameter Id="[email protected]" DataType="string" Value="APAC" />
97+
<InputParameter Id="[email protected]" DataType="string" Value="APAC" />
98+
<InputParameter Id="errorOnFailedLookup" DataType="boolean" Value="false" />
99+
</InputParameters>
100+
<OutputClaims>
101+
<OutputClaim ClaimTypeReferenceId="userLookupRegion" TransformationClaimType="outputClaim" />
102+
</OutputClaims>
103+
</ClaimsTransformation>
104+
```
105+
106+
1. Configure API based authentication for traveling user, and MS Graph API call to fetch users profile.
107+
1. Check credentials and get MS Graph API token from respective tenant. Register **Native** app registration in each regional tenant with permissions to MS Graph API for delegated permission: *user.read*.
108+
109+
```xml
110+
<TechnicalProfile Id="REST-login-NonInteractive-APAC">
111+
<DisplayName>non interactive authetnication to APAC</DisplayName>
112+
<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
113+
<Metadata>
114+
<Item Key="ServiceUrl">https://login.microsoftonline.com/b2capac.onmicrosoft.com/oauth2/v2.0/token</Item>
115+
<Item Key="AuthenticationType">None</Item>
116+
<Item Key="SendClaimsIn">Form</Item>
117+
<Item Key="AllowInsecureAuthInProduction">true</Item>
118+
</Metadata>
119+
<InputClaims>
120+
<InputClaim ClaimTypeReferenceId="apac_client_id" PartnerClaimType="client_id" DefaultValue="cf3f6898-9a79-426a-ba16-10e1a377c843" />
121+
<InputClaim ClaimTypeReferenceId="ropc_grant_type" PartnerClaimType="grant_type" DefaultValue="password" />
122+
<InputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="username" />
123+
<InputClaim ClaimTypeReferenceId="password" />
124+
<InputClaim ClaimTypeReferenceId="scope" DefaultValue="https://graph.microsoft.com/.default" AlwaysUseDefaultValue="true" />
125+
<InputClaim ClaimTypeReferenceId="nca" PartnerClaimType="nca" DefaultValue="1" />
126+
</InputClaims>
127+
<OutputClaims>
128+
<OutputClaim ClaimTypeReferenceId="bearerToken" PartnerClaimType="access_token" />
129+
</OutputClaims>
130+
<UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
131+
</TechnicalProfile>
132+
```
133+
134+
1. Read profile via MS Graph API for traveling user.
135+
136+
```xml
137+
<TechnicalProfile Id="Azure AD-Read-User-MSGraph">
138+
<DisplayName>revoke my refresh token</DisplayName>
139+
<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
140+
<Metadata>
141+
<Item Key="ServiceUrl">https://graph.microsoft.com/beta/me</Item>
142+
<Item Key="AuthenticationType">Bearer</Item>
143+
<Item Key="UseClaimAsBearerToken">bearerToken</Item>
144+
<Item Key="SendClaimsIn">Url</Item>
145+
<Item Key="DebugMode">true</Item>
146+
</Metadata>
147+
<InputClaims>
148+
<InputClaim ClaimTypeReferenceId="bearerToken" />
149+
</InputClaims>
150+
<OutputClaims>
151+
<OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="id" />
152+
<OutputClaim ClaimTypeReferenceId="givenName" />
153+
<OutputClaim ClaimTypeReferenceId="surName" />
154+
<OutputClaim ClaimTypeReferenceId="displayName" />
155+
<OutputClaim ClaimTypeReferenceId="userPrincipalName" PartnerClaimType="upn" />
156+
<OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
157+
</OutputClaims>
158+
<UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
159+
</TechnicalProfile>
160+
```
161+
162+
## Sign up
163+
164+
Write users region to global lookup table.
165+
> [!NOTE]
166+
> No setup due to hardcoded lookup table.
167+
168+
## Password reset
169+
170+
1. Configure identifier to region lookup via global lookup table.
171+
> [!NOTE]
172+
> No setup due to hardcoded lookup table.
173+
174+
1. Configure cross tenant password reset via REST API call.
175+
>[!NOTE]
176+
>Will require brokering API using client_credential authentication and User Admin role applied to the service principal.
177+
178+
## Next steps
179+
180+
- [Azure AD B2C global identity proof of concept regional-based configuration](azure-ad-b2c-global-identity-proof-of-concept-regional.md)
181+
182+
- [Azure AD B2C global identity solutions](azure-ad-b2c-global-identity-solutions.md)
183+
184+
- [Build a global identity solution with funnel-based approach](azure-ad-b2c-global-identity-funnel-based-design.md)
185+
186+
- [Build a global identity solution with region-based approach](azure-ad-b2c-global-identity-funnel-based-design.md)
187+

0 commit comments

Comments
 (0)