You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/partner-eid-me.md
+39-37Lines changed: 39 additions & 37 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -51,7 +51,7 @@ eID-Me integrates with Azure AD B2C as an OpenID Connect (OIDC) identity provide
51
51
* The application receives identity claims received by Azure AD B2C during transaction
52
52
***eID-Me smartphone apps** - Azure AD B2C tenant users need the app for iOS or Android
53
53
***Issued eID-Me digital identities** - from eID-Me identity proofing
54
-
* Users are issued a digital identity to the digital wallet in the app. Valid identity documents required.
54
+
* Users are issued a digital identity to the digital wallet in the app. Valid identity documents are required.
55
55
56
56
The eID-Me apps authenticate users during transactions. The X509 public key authentication provides passwordless MFA, using a private signing key in the eID-Me digital identity.
57
57
@@ -105,7 +105,7 @@ For the following instructions, use the directory with the Azure AD B2C tenant.
105
105
1. Sign in to the [Azure portal](https://portal.azure.com/#home) as Global Administrator of the Azure AD B2C tenant.
106
106
2. In the top menu, select **Directory + subscription**.
107
107
3. Select the directory with the tenant.
108
-
4. In the top-left corner of the Azure portal, select **All services**.\
108
+
4. In the top-left corner of the Azure portal, select **All services**.
109
109
5. Search for and select **Azure AD B2C**.
110
110
6. Navigate to **Dashboard** > **Azure Active Directory B2C** > **Identity providers**.
111
111
7. Select **New OpenID Connect Provider**.
@@ -384,17 +384,20 @@ For the following instructions, the identity provider is set up, but not in any
384
384
3. Open the `TrustFrameworkExtensions.xml`.
385
385
4. Locate the **UserJourneys** element. If the element doesn't appear, add one.
386
386
5. Paste the contents of the **UserJourney** element as a child of the **UserJourneys** element.
387
-
6. Rename the user journey ID, for example, ID=`CustomSignUpSignIn`
387
+
6. Rename the user journey ID, for example, ID=`CustomSignUpSignIn`.
388
388
389
389
## Add the identity provider to a user journey
390
390
391
-
Now that you have a user journey, add the new identity provider to the user journey.
391
+
Add the new identity provider to the user journey.
392
392
393
-
1. Find the orchestration step element that includes Type=`CombinedSignInAndSignUp`, or Type=`ClaimsProviderSelection` in the user journey. It's usually the first orchestration step. The **ClaimsProviderSelections** element contains a list of identity providers that a user can sign in with. The order of the elements controls the order of the sign-in buttons presented to the user. Add a **ClaimsProviderSelection** XML element. Set the value of **TargetClaimsExchangeId** to a friendly name.
393
+
1. In the user journey, locate the orchestration step element with Type=`CombinedSignInAndSignUp`, or Type=`ClaimsProviderSelection`. It's usually the first orchestration step. The **ClaimsProviderSelections** element has a list of identity providers users sign in with. The order of the elements controls the order of the sign-in buttons the user sees.
394
+
2. Add a **ClaimsProviderSelection** XML element.
395
+
3. Set the **TargetClaimsExchangeId** value to a friendly name.
396
+
4. In the next orchestration step, add a **ClaimsExchange** element.
397
+
5. Set the **Id** to the target claims exchange ID value.
398
+
6. Update the v**TechnicalProfileReferenceId** value to the technical profile ID you created.
394
399
395
-
2. In the next orchestration step, add a **ClaimsExchange** element. Set the **Id** to the value of the target claims exchange ID. Update the value of **TechnicalProfileReferenceId** to the ID of the technical profile you created earlier.
396
-
397
-
The following XML demonstrates **7** orchestration steps of a user journey with the identity provider:
400
+
The following XML demonstrates 7 user journey orchestration steps with the identity provider:
398
401
399
402
```xml
400
403
<UserJourneyId="eIDME-SignUpOrSignIn">
@@ -475,9 +478,9 @@ Now that you have a user journey, add the new identity provider to the user jour
475
478
476
479
```
477
480
478
-
## Step 6: Configure the relying party policy
481
+
## Configure the relying party policy
479
482
480
-
The relying party policy specifies the user journey which Azure AD B2C will execute. You can also control what claims are passed to your application by adjusting the **OutputClaims** element of the **eID-Me-OIDC-Signup** TechnicalProfile element. In this sample, the application will receive the user’s postal code, locality, region, IAL, portrait, middle name, and birth date. It also receives the boolean **signupConditionsSatisfied** claim, which indicates whether an account has been created or not:
483
+
The relying party policy specifies the user journey Azure AD B2C executes. You can control claims passed to your application. Adjust the **OutputClaims** element of the **eID-Me-OIDC-Signup** TechnicalProfile element. In the following sample, the application receives user postal code, locality, region, IAL, portrait, middle name, and birth date. It receives the boolean **signupConditionsSatisfied** claim, which indicates whether an account was created.
481
484
482
485
```xml
483
486
<RelyingParty>
@@ -508,40 +511,39 @@ The relying party policy specifies the user journey which Azure AD B2C will exec
508
511
509
512
```
510
513
511
-
## Step 7: Upload the custom policy
512
-
513
-
1. Sign in to the [Azure portal](https://portal.azure.com/#home).
514
-
515
-
2. Make sure you're using the directory that contains your Azure AD B2C tenant. Select the **Directories + subscriptions** icon in the portal toolbar.
516
-
517
-
3. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**.
518
-
519
-
4. In the [Azure portal](https://portal.azure.com/#home), search for and select **Azure AD B2C**.
520
-
521
-
5. Under Policies, select **Identity Experience Framework**.
522
-
Select **Upload Custom Policy**, and then upload the two policy files that you changed, in the following order: the extension policy, for example `TrustFrameworkBase.xml`, then the relying party policy, such as `SignUp.xml`.
514
+
## Upload the custom policy
523
515
524
-
## Step 8: Test your custom policy
516
+
For the following instructions, use the directory with the Azure AD B2C tenant.
525
517
526
-
1. Select your relying party policy, for example `B2C_1A_signup`.
518
+
1. Sign in to the [Azure portal](https://portal.azure.com/#home).
519
+
2. In the portal toolbar, select the **Directories + subscriptions**.
520
+
3. On the **Portal settings, Directories + subscriptions** page, in the **Directory name** list, locate the Azure AD B2C directory.
521
+
4. Select **Switch**.
522
+
5. In the Azure portal, search for and select **Azure AD B2C**.
523
+
6. Under **Policies**, select **Identity Experience Framework**.
524
+
7. Select **Upload Custom Policy**.
525
+
8. Upload the two policy files you changed in the following order:
527
526
528
-
2. For **Application**, select a web application that you [previously registered](./tutorial-register-applications.md). The **Reply URL** should show `https://jwt.ms`.
527
+
* The extension policy, for example `TrustFrameworkBase.xml`
528
+
* The relying party policy, for example `SignUp.xml`
529
529
530
-
3. Select the **Run now** button.
530
+
## Test the custom policy
531
531
532
-
4. The sign-up policy should invoke eID-Me immediately. If sign-in is used, then select eID-Me to sign in with eID-Me.
532
+
1. Select the relying party policy, for example `B2C_1A_signup`.
533
+
2. For **Application**, select a web application you registered.
534
+
3. The **Reply URL** is `https://jwt.ms`.
535
+
4. Select **Run now**.
536
+
5. The sign-up policy invokes eID-Me.
537
+
6. For sign-in, select **eID-Me**.
538
+
7. The browser redirects to `https://jwt.ms`.
539
+
8. The token contents returned by Azure AD B2C appear.
533
540
534
-
If the sign-in process is successful, your browser is redirected to `https://jwt.ms`, which displays the contents of the token returned by Azure AD B2C.
541
+
Learn more: [Tutorial: Register a web application in Azure AD B2C](./tutorial-register-applications.md)
535
542
536
543
## Next steps
537
544
538
-
For additional information, review the following articles:
539
-
540
-
-[Custom policies in Azure AD B2C](./custom-policy-overview.md)
541
-
542
-
-[Get started with custom policies in Azure AD B2C](./tutorial-create-user-flows.md?pivots=b2c-custom-policy)
543
-
544
-
-[Sample code to integrate Azure AD B2C with eID-Me](https://github.com/bluink-stephen/eID-Me_Azure_AD_B2C)
545
-
546
-
-[eID-Me and Azure AD B2C integration guide](https://bluink.ca/eid-me/azure-b2c-integration-guide)
545
+
*[Azure AD B2C custom policy overview](./custom-policy-overview.md)
546
+
*[Tutorial: Create user flows and custom policies in Azure Active Directory B2C](./tutorial-create-user-flows.md?pivots=b2c-custom-policy)
547
+
*[A Custom Policy Template and Sample ASP.NET Core Web app for integrating eID-Me with Azure AD B2C](https://github.com/bluink-stephen/eID-Me_Azure_AD_B2C)
548
+
* Go to bluink.ca for the [Azure AD B2C ID Verification Integration Guide | eID-Me](https://bluink.ca/eid-me/azure-b2c-integration-guide)
0 commit comments