Skip to content

Commit 933f647

Browse files
v-edmckillopv-edmckillop
authored
Update partner-keyless.md
1 parent 6650eb8 commit 933f647

File tree

1 file changed

+86
-107
lines changed

1 file changed

+86
-107
lines changed

‎articles/active-directory-b2c/partner-keyless.md

Lines changed: 86 additions & 107 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
2-
title: Tutorial for configuring Keyless with Azure Active Directory B2C
2+
title: Tutorial to configure Keyless with Azure Active Directory B2C
33
titleSuffix: Azure AD B2C
4-
description: Tutorial for configuring Keyless with Azure Active Directory B2C for passwordless authentication
4+
description: Tutorial to configure Sift Keyless with Azure Active Directory B2C for passwordless authentication
55
services: active-directory-b2c
66
author: gargi-sinha
77
manager: martinco
@@ -16,139 +16,118 @@ ms.subservice: B2C
1616

1717
# Tutorial: Configure Keyless with Azure Active Directory B2C
1818

19-
In this sample tutorial, we provide guidance on how to configure Azure Active Directory (AD) B2C with [Keyless](https://keyless.io/). With Azure AD B2C as an Identity provider, you can integrate Keyless with any of your customer applications to provide true passwordless authentication to your users.
19+
Learn to configure Azure Active Directory B2C (Azure AD B2C) with the Sift Keyless passwordless solution. With Azure AD B2C as an identity provider (IdP), integrate Keyless with customer applications to provide passwordless authentication. The Keyless Zero-Knowledge Biometric (ZKB) is passwordless multi-factor authentication that helps eliminate fraud, phishing, and credential reuse, while enhancing the customer experience and protecting privacy.
2020

21-
Keyless's solution **Keyless Zero-Knowledge Biometric (ZKB™)** provides passwordless multifactor authentication that eliminates fraud, phishing, and credential reuse – all while enhancing customer experience and protecting their privacy.
21+
Go to keyless.io to learn about:
2222

23-
## Pre-requisites
23+
* [Sift Keyless](https://keyless.io/)
24+
* [How Keyless uses zero-knowledge proofs to protect your biometric data](https://keyless.io/blog/post/how-keyless-uses-zero-knowledge-proofs-to-protect-your-biometric-data)
2425

25-
To get started, you'll need:
26-
27-
- An Azure subscription. If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/).
28-
29-
- An [Azure AD B2C tenant](./tutorial-create-tenant.md). Tenant must be linked to your Azure subscription.
26+
## Prerequisites
3027

31-
- A Keyless cloud tenant, get a free [trial account](https://keyless.io/go).
28+
To get started, you'll need:
3229

33-
- The Keyless Authenticator app installed on your user’s device.
30+
* An Azure subscription
31+
* If you don't have one, get an [Azure free account](https://azure.microsoft.com/free/)
32+
* An [Azure AD B2C tenant](./tutorial-create-tenant.md) linked to the Azure subscription
33+
* A Keyless cloud tenant
34+
* Go to keyless.io to [Reqest a demo](https://keyless.io/go)
35+
* The Keyless Authenticator app installed on a user device
3436

3537
## Scenario description
3638

3739
The Keyless integration includes the following components:
3840

39-
- Azure AD B2C – The authorization server, responsible for verifying the user’s credentials, also known as the identity provider.
40-
41-
- Web and mobile applications – Your mobile or web applications that you choose to protect with Keyless and Azure AD B2C.
41+
* **Azure AD B2C** – authorization server that verifies user credentials, or the IdP
42+
* **Web and mobile applications** – mobile or web applications to protect with Keyless and Azure AD B2C
43+
* **The Keyless Authenticator mobile app** – Sift mobile app for authentication to the Azure AD B2C enabled applications
4244

43-
- The Keyless mobile app – The Keyless mobile app will be used for authentication to the Azure AD B2C enabled applications.
45+
The following architecture diagram illustrates an implementation.
4446

45-
The following architecture diagram shows the implementation.
47+
![Image shows Keyless architecture diagram](./media/partner-keyless/keyless-architecture-diagram.png)
4648

47-
![Image shows Keyless architecture diagram](./media/partner-keyless/keyless-architecture-diagram.png)
49+
1. User arrives at a sign-in page. User selects sign-in/sign-up and enters the username.
50+
2. The application sends user attributes to Azure AD B2C for identity verification.
51+
3. Azure AD B2C sends user attributes to Keyless for authentication.
52+
4. Keyless sends a push notification to the users' registered mobile device for authentication, a facial biometric scan.
53+
5. The user responds to the push notification and is granted or denied access.
4854

49-
|Step | Description |
50-
|:-----| :-----------|
51-
| 1. | User arrives at a login page. Users select sign-in/sign-up and enters the username
52-
| 2. | The application sends the user attributes to Azure AD B2C for identity verification.
53-
| 3. | Azure AD B2C collects the user attributes and sends the attributes to Keyless to authenticate the user through the Keyless mobile app.
54-
| 4. | Keyless sends a push notification to the registered user's mobile device for a privacy-preserving authentication in the form of a facial biometric scan.
55-
| 5. | After the user responds to the push notification, the user is either granted or denied access to the customer application based on the verification results.
55+
## Add an IdP, configure the IdP, and create a user flow policy
5656

57-
## Integrate with Azure AD B2C
57+
Use the following sections to add an IdP, configure the IdP, and create a user flow policy.
5858

5959
### Add a new Identity provider
6060

61-
To add a new Identity provider, follow these steps:
62-
63-
1. Sign in to the **[Azure portal](https://portal.azure.com/#home)** as the global administrator of your Azure AD B2C tenant.
64-
1. Make sure you're using the directory that contains your Azure AD B2C tenant. Select the **Directories + subscriptions** icon in the portal toolbar.
65-
1. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**.
66-
1. Choose **All services** in the top-left corner of the Azure portal, search for and select **Azure AD B2C**.
67-
1. Navigate to **Dashboard** > **Azure Active Directory B2C** > **Identity providers**
68-
1. Select **Identity providers**.
69-
1. Select **Add**.
70-
71-
### Configure an Identity provider
72-
73-
To configure an identity provider, follow these steps:
74-
75-
1. Select **Identity provider type** > **OpenID Connect (Preview)**
76-
1. Fill out the form to set up the Identity provider:
77-
78-
|Property | Value |
79-
|:-----| :-----------|
80-
| Name | Keyless |
81-
| Metadata URL | Insert the URI of the hosted Keyless Authentication app, followed by the specific path such as 'https://keyless.auth/.well-known/openid-configuration' |
82-
| Client Secret | The secret associated with the Keyless Authentication instance - not same as the one configured before. Insert a complex string of your choice. This secret will be used later in the Keyless Container configuration.|
83-
| Client ID | The ID of the client. This ID will be used later in the Keyless Container configuration.|
84-
| Scope | openid |
85-
| Response type | id_token |
86-
| Response mode | form_post|
87-
88-
1. Select **OK**.
89-
90-
1. Select **Map this identity provider’s claims**.
91-
92-
1. Fill out the form to map the Identity provider:
93-
94-
|Property | Value |
95-
|:-----| :-----------|
96-
| UserID | From subscription |
97-
| Display name | From subscription |
98-
| Response mode | From subscription |
99-
100-
1. Select **Save** to complete the setup for your new Open ID Connect (OIDC) Identity provider.
61+
To add a new Identity provider:
62+
63+
1. Sign in to the **[Azure portal](https://portal.azure.com/#home)** as Global Administrator of the Azure AD B2C tenant.
64+
2. Select **Directories + subscriptions**.
65+
3. On the **Portal settings, Directories + subscriptions** page, in the **Directory name** list, find your Azure AD B2C directory.
66+
4. Select **Switch**.
67+
5. In the top-left corner of the Azure portal, select **All services**.
68+
6. Search for and select **Azure AD B2C**.
69+
7. Navigate to **Dashboard** > **Azure Active Directory B2C** > **Identity providers**.
70+
8. Select **Identity providers**.
71+
9. Select **Add**.
72+
73+
### Configure an identity provider
74+
75+
To configure an IdP:
76+
77+
1. Select **Identity provider type** > **OpenID Connect (Preview)**.
78+
2. For **Name**, select **Keyless**.
79+
3. For **Metadata URL**, insert the hosted Keyless Authentication app URI, followed by the path, such as `https://keyless.auth/.well-known/openid-configuration`.
80+
4. For **Client Secret**, select the secret associated with the Keyless Authentication instance. The secret is used later in Keyless Container configuration.
81+
5. For **Client ID**, select the client ID. The Client ID is used later in Keyless Container configuration.
82+
6. For **Scope**, select **openid**.
83+
7. For **Response type**, select **id_token**.
84+
8. For **Response mode**, select **form_post**.
85+
9. Select **OK**.
86+
10. Select **Map this identity provider’s claims**.
87+
11. For **UserID**, select **From subscription**.
88+
12. For **Display name**, select **From subscription**.
89+
13. For **Response mode**, select **From subscription**.
90+
14. Select **Save**.
10191

10292
### Create a user flow policy
10393

104-
You should now see Keyless as a new OIDC Identity provider listed within your B2C identity providers.
94+
Keyless appears as a new OpenID Connect (OIDC) IdP with B2C identity providers.
10595

10696
1. In your Azure AD B2C tenant, under **Policies**, select **User flows**.
107-
10897
2. Select **New** user flow.
109-
110-
3. Select **Sign up and sign in**, select a **version**, and then select **Create**.
111-
112-
4. Enter a **Name** for your policy.
113-
114-
5. In the Identity providers section, select your newly created Keyless Identity Provider.
115-
116-
6. Set up the parameters of your User flow. Insert a name and select the Identity provider you’ve created. You can also add email address. In this case, Azure won’t redirect the login procedure directly to Keyless instead it will show a screen where the user can choose the option they would like to use.
117-
118-
7. Leave the **Multi-factor Authentication** field as is.
119-
120-
8. Select **Enforce conditional access policies**
121-
122-
9. Under **User attributes and token claims**, select **Email Address** in the Collect attribute option. You can add all the attributes that Azure Active Directory can collect about the user alongside the claims that Azure AD B2C can return to the client application.
123-
124-
10. Select **Create**.
125-
126-
11. After a successful creation, select your new **User flow**.
127-
128-
12. On the left panel, select **Application Claims**. Under options, tick the **email** checkbox and select **Save**.
98+
3. Select **Sign up and sign in**.
99+
4. Select a **version**.
100+
5. Select **Create**.
101+
6. Enter a **Name** for your policy.
102+
7. In the Identity providers section, select the created Keyless Identity Provider.
103+
8. Enter a name.
104+
9. Select the IdP you created.
105+
10. Add an email address. Azure won’t redirect the sign-in to Keyless; a screen appears with a user option.
106+
11. Leave the **Multi-factor Authentication** field.
107+
12. Select **Enforce conditional access policies**.
108+
13. Under **User attributes and token claims**, in the **Collect attribute** option, select **Email Address**.
109+
14. Add user attributes Azure AD collects with claims Azure AD B2C returns to the client application.
110+
15. Select **Create**.
111+
16. Select the new **User flow**.
112+
17. On the left panel, select **Application Claims**.
113+
18. Under options, select the **email** checkbox.
114+
19. Select **Save**.
129115

130116
## Test the user flow
131117

132-
1. Open the Azure AD B2C tenant and under Policies select Identity Experience Framework.
118+
1. Open the Azure AD B2C tenant.
119+
2. Under **Policies** select **Identity Experience Framework**.
120+
3. Select the created SignUpSignIn.
121+
4. Select **Run user flow**.
122+
5. For **Application**, select the registered app (the example is JWT).
123+
6. For **Reply URL**, select the redirect URL.
124+
7. Select **Run user flow**.
125+
8. Complete the sign-up flow and create an account.
126+
9. After the user attribute is created, Keyless is called during the flow.
133127

134-
2. Select your previously created SignUpSignIn.
135-
136-
3. Select Run user flow and select the settings:
137-
138-
a. Application: select the registered app (sample is JWT)
139-
140-
b. Reply URL: select the redirect URL
141-
142-
c. Select Run user flow.
143-
144-
4. Go through sign-up flow and create an account
145-
146-
5. Keyless will be called during the flow, after user attribute is created. If the flow is incomplete, check that user isn't saved in the directory.
128+
If the flow is incomplete, confirm user is or isn't saved in the directory.
147129

148130
## Next steps
149131

150-
For additional information, review the following articles:
151-
152-
- [Custom policies in Azure AD B2C](./custom-policy-overview.md)
153-
154-
- [Get started with custom policies in Azure AD B2C](tutorial-create-user-flows.md?pivots=b2c-custom-policy)
132+
* [Azure AD B2C custom policy overview](./custom-policy-overview.md)
133+
* [Tutorial: Create user flows and custom policies in Azure AD B2C](tutorial-create-user-flows.md?pivots=b2c-custom-policy)

0 commit comments

Comments
 (0)