Skip to content

Commit ac6ca6c

Browse files
yoelhoryoelhor
authored
Create identity-provider-mobile-id.md
1 parent 1d03fed commit ac6ca6c

File tree

1 file changed

+208
-0
lines changed

1 file changed

+208
-0
lines changed

‎articles/active-directory-b2c/identity-provider-mobile-id.md

Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,208 @@
1+
---
2+
title: Set up sign-up and sign-in with a Mobile ID account
3+
titleSuffix: Azure AD B2C
4+
description: Provide sign-up and sign-in to customers with Mobile ID accounts in your applications using Azure Active Directory B2C.
5+
services: active-directory-b2c
6+
author: kengaderdus
7+
manager: celestedg
8+
9+
ms.service: active-directory
10+
ms.workload: identity
11+
ms.topic: how-to
12+
ms.date: 04/08/2022
13+
ms.author: kengaderdus
14+
ms.subservice: B2C
15+
zone_pivot_groups: b2c-policy-type
16+
---
17+
18+
# Set up sign-up and sign-in with a Mobile ID account using Azure Active Directory B2C
19+
20+
[!INCLUDE [active-directory-b2c-choose-user-flow-or-custom-policy](../../includes/active-directory-b2c-choose-user-flow-or-custom-policy.md)]
21+
22+
In this article, you learn how to provide sign-up and sign-in to customers with [Mobile ID](https://www.mobileid.ch) accounts in your applications using Azure Active Directory B2C (Azure AD B2C). The Mobile ID solution protects access to your company data and applications with a comprehensive end-to- end solution for a strong multi-factor authentication (MFA). You add the Mobile ID to your user flows or custom policy using OpenID Connect protocol.
23+
24+
## Prerequisites
25+
26+
[!INCLUDE [active-directory-b2c-customization-prerequisites](../../includes/active-directory-b2c-customization-prerequisites.md)]
27+
28+
## Create a Mobile ID application
29+
30+
To enable sign-in for users with a Mobile ID account in Azure AD B2C, you need to create an application. To create Mobile ID application, follow these steps:
31+
32+
1. Contact [Mobile ID support](https://www.mobileid.ch/en/contact).
33+
1. Provide the Mobile ID the information about your Azure AD B2C tenant:
34+
35+
36+
|Key |Note |
37+
|---------|---------|
38+
|Redirect URI | Provide the `https://your-tenant-name.b2clogin.com/your-tenant-name.onmicrosoft.com/oauth2/authresp` URI. If you use a [custom domain](custom-domain.md), enter `https://your-domain-name/your-tenant-name.onmicrosoft.com/oauth2/authresp`. Replace `your-tenant-name` with the name of your tenant, and `your-domain-name` with your custom domain. |
39+
|Token endpoint authentication method| `client_secret_post`|
40+
41+
42+
1. After the app is registered, the following information will be provided by the Mobile ID. Use this information to configure your user flow, or custom policy.
43+
44+
|Key |Note |
45+
|---------|---------|
46+
| Client ID | The Mobile ID client ID. For example, 11111111-2222-3333-4444-555555555555. |
47+
| Client Secret| The Mobile ID client secret.|
48+
49+
50+
::: zone pivot="b2c-user-flow"
51+
52+
## Configure Mobile ID as an identity provider
53+
54+
1. Make sure you're using the directory that contains Azure AD B2C tenant. Select the **Directory + subscription** filter in the top menu and choose the directory that contains your Azure AD B2C tenant.
55+
1. Choose **All services** in the top-left corner of the Azure portal, and then search for and select **Azure AD B2C**.
56+
1. Select **Identity providers**, and then select **New OpenID Connect provider**.
57+
1. Enter a **Name**. For example, enter *Mobile ID*.
58+
1. For **Metadata url**, enter the URL Mobile ID OpenId well-known configuration endpoint. For example:
59+
60+
```http
61+
https://openid.mobileid.ch/.well-known/openid-configuration
62+
```
63+
64+
1. For **Client ID**, enter the Mobile ID Client ID.
65+
1. For **Client secret**, enter the Mobile ID client secret.
66+
1. For the **Scope**, enter the `openid, profile, phone, mid_profile`.
67+
1. Leave the default values for **Response type** (`code`), and **Response mode** (`form_post`).
68+
1. (Optional) For the **Domain hint**, enter `mobileid.com`. For more information, see [Set up direct sign-in using Azure Active Directory B2C](direct-signin.md#redirect-sign-in-to-a-social-provider).
69+
1. Under **Identity provider claims mapping**, select the following claims:
70+
71+
- **User ID**: *sub*
72+
- **Display name**: *name*
73+
74+
75+
1. Select **Save**.
76+
77+
## Add Mobile ID identity provider to a user flow
78+
79+
At this point, the Mobile ID identity provider has been set up, but it's not yet available in any of the sign-in pages. To add the Mobile ID identity provider to a user flow:
80+
81+
1. In your Azure AD B2C tenant, select **User flows**.
82+
1. Click the user flow that you want to add the Mobile ID identity provider.
83+
1. Under the **Social identity providers**, select **Mobile ID**.
84+
1. Select **Save**.
85+
1. To test your policy, select **Run user flow**.
86+
1. For **Application**, select the web application named *testapp1* that you previously registered. The **Reply URL** should show `https://jwt.ms`.
87+
1. Select the **Run user flow** button.
88+
1. From the sign-up or sign-in page, select **Mobile ID** to sign in with Mobile ID account.
89+
90+
If the sign-in process is successful, your browser is redirected to `https://jwt.ms`, which displays the contents of the token returned by Azure AD B2C.
91+
92+
::: zone-end
93+
94+
::: zone pivot="b2c-custom-policy"
95+
96+
## Create a policy key
97+
98+
You need to store the client secret that you received from Mobile ID in your Azure AD B2C tenant.
99+
100+
1. Sign in to the [Azure portal](https://portal.azure.com/).
101+
2. Make sure you're using the directory that contains your Azure AD B2C tenant. Select the **Directory + subscription** filter in the top menu and choose the directory that contains your tenant.
102+
3. Choose **All services** in the top-left corner of the Azure portal, and then search for and select **Azure AD B2C**.
103+
4. On the Overview page, select **Identity Experience Framework**.
104+
5. Select **Policy Keys** and then select **Add**.
105+
6. For **Options**, choose `Manual`.
106+
7. Enter a **Name** for the policy key. For example, `Mobile IDSecret`. The prefix `B2C_1A_` is added automatically to the name of your key.
107+
8. In **Secret**, enter your Mobile ID client secret.
108+
9. For **Key usage**, select `Signature`.
109+
10. Click **Create**.
110+
111+
## Configure Mobile ID as an identity provider
112+
113+
To enable users to sign in using a Mobile ID account, you need to define the account as a claims provider that Azure AD B2C can communicate with through an endpoint. The endpoint provides a set of claims that are used by Azure AD B2C to verify that a specific user has authenticated.
114+
115+
You can define a Mobile ID account as a claims provider by adding it to the **ClaimsProviders** element in the extension file of your policy.
116+
117+
1. Open the *TrustFrameworkExtensions.xml*.
118+
2. Find the **ClaimsProviders** element. If it does not exist, add it under the root element.
119+
3. Add a new **ClaimsProvider** as follows:
120+
121+
```xml
122+
<ClaimsProvider>
123+
<Domain>mobileid.ch</Domain>
124+
<DisplayName>Mobile-ID</DisplayName>
125+
<TechnicalProfiles>
126+
<TechnicalProfile Id="MobileID-OAuth2">
127+
<DisplayName>Mobile-ID</DisplayName>
128+
<Protocol Name="OAuth2" />
129+
<Metadata>
130+
<Item Key="ProviderName">Mobile-ID</Item>
131+
<Item Key="authorization_endpoint">https://m.mobileid.ch/oidc/authorize</Item>
132+
<Item Key="AccessTokenEndpoint">https://openid.mobileid.ch/token</Item>
133+
<Item Key="ClaimsEndpoint">https://openid.mobileid.ch/userinfo</Item>
134+
<Item Key="scope">openid, profile, phone, mid_profile</Item>
135+
<Item Key="HttpBinding">POST</Item>
136+
<Item Key="UsePolicyInRedirectUri">false</Item>
137+
<Item Key="token_endpoint_auth_method">client_secret_post</Item>
138+
<Item Key="BearerTokenTransmissionMethod">AuthorizationHeader</Item>
139+
<Item Key="client_id">Your application ID</Item>
140+
</Metadata>
141+
<CryptographicKeys>
142+
<Key Id="client_secret" StorageReferenceId="B2C_1A_MobileIdSecret" />
143+
</CryptographicKeys>
144+
<OutputClaims>
145+
<OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="sub"/>
146+
<OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name"/>
147+
<OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="mobileid.ch" />
148+
<OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" />
149+
</OutputClaims>
150+
<OutputClaimsTransformations>
151+
<OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
152+
<OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
153+
<OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
154+
<OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
155+
</OutputClaimsTransformations>
156+
<UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
157+
</TechnicalProfile>
158+
</TechnicalProfiles>
159+
</ClaimsProvider>
160+
```
161+
162+
4. Set **client_id** to the Mobile ID client ID.
163+
5. Save the file.
164+
165+
[!INCLUDE [active-directory-b2c-add-identity-provider-to-user-journey](../../includes/active-directory-b2c-add-identity-provider-to-user-journey.md)]
166+
167+
168+
```xml
169+
<OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
170+
<ClaimsProviderSelections>
171+
...
172+
<ClaimsProviderSelection TargetClaimsExchangeId="MobileIDExchange" />
173+
</ClaimsProviderSelections>
174+
...
175+
</OrchestrationStep>
176+
177+
<OrchestrationStep Order="2" Type="ClaimsExchange">
178+
...
179+
<ClaimsExchanges>
180+
<ClaimsExchange Id="MobileIDExchange" TechnicalProfileReferenceId="MobileID-OAuth2" />
181+
</ClaimsExchanges>
182+
</OrchestrationStep>
183+
```
184+
185+
[!INCLUDE [active-directory-b2c-configure-relying-party-policy](../../includes/active-directory-b2c-configure-relying-party-policy-user-journey.md)]
186+
187+
## Test your custom policy
188+
189+
1. Select your relying party policy, for example `B2C_1A_signup_signin`.
190+
1. For **Application**, select a web application that you [previously registered](tutorial-register-applications.md). The **Reply URL** should show `https://jwt.ms`.
191+
1. Select the **Run now** button.
192+
1. From the sign-up or sign-in page, select **Mobile ID** to sign in with Mobile ID account.
193+
194+
If the sign-in process is successful, your browser is redirected to `https://jwt.ms`, which displays the contents of the token returned by Azure AD B2C.
195+
196+
197+
::: zone-end
198+
199+
## Move to production
200+
201+
Mobile ID IdP provides Pre-production and Production environments. The configuration described in this article uses the pre-production environment. To use the production environment, follow these steps:
202+
203+
1. Contact Mobile ID support for a production environment.
204+
1. Update your user flow or custom policy with the URI of the well-known configuration endpoint.
205+
206+
## Next steps
207+
208+
Learn how to [pass Mobile ID token to your application](idp-pass-through-user-flow.md).

0 commit comments

Comments
 (0)