Skip to content

Commit b33c9ad

Browse files
huypubhuypub
authored
Merge pull request #127256 from MicrosoftDocs/master
8/25 PM Publish
2 parents ac7ae29 + e4bd77e commit b33c9ad

File tree

192 files changed

+4871
-1627
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

192 files changed

+4871
-1627
lines changed

‎articles/active-directory-b2c/custom-policy-developer-notes.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -108,10 +108,10 @@ Custom policy/Identity Experience Framework capabilities are under constant and
108108

109109
| Feature | Development | Preview | GA | Notes |
110110
| ------- | :-----------: | :-------: | :--: | ----- |
111-
| [2.0.0](page-layout.md#200) | | X | | |
112-
| [1.2.0](page-layout.md#120) | | X | | |
113-
| [1.1.0](page-layout.md#110) | | | X | |
114-
| [1.0.0](page-layout.md#100) | | | X | |
111+
| [2.0.0](page-layout.md) | | X | | |
112+
| [1.2.0](page-layout.md) | | X | | |
113+
| [1.1.0](page-layout.md) | | | X | |
114+
| [1.0.0](page-layout.md) | | | X | |
115115
| [JavaScript support](javascript-samples.md) | | X | | |
116116

117117
### App-IEF integration

‎articles/active-directory-b2c/page-layout.md

Lines changed: 120 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ manager: celestedg
99
ms.service: active-directory
1010
ms.workload: identity
1111
ms.topic: reference
12-
ms.date: 07/30/2020
12+
ms.date: 08/24/2020
1313
ms.author: mimart
1414
ms.subservice: B2C
1515
---
@@ -20,56 +20,125 @@ Page layout packages are periodically updated to include fixes and improvements
2020

2121
[!INCLUDE [active-directory-b2c-public-preview](../../includes/active-directory-b2c-public-preview.md)]
2222

23-
## 2.1.0
24-
25-
- Self-asserted page (`selfasserted`)
26-
- Localization and accessibility fixes.
27-
- Unified SSP page (`unifiedssp`)
28-
- Added support for multiple sign-up links.
29-
- Added support for user input validation according to the predicate rules defined in the policy.
30-
31-
## 2.0.0
32-
33-
- Self-asserted page (`selfasserted`)
34-
- Added support for [display controls](display-controls.md) in custom policies.
35-
36-
## 1.2.0
37-
38-
- All pages
39-
- Accessibility fixes
40-
- You can now add the `data-preload="true"` attribute [in your HTML tags](custom-policy-ui-customization.md#guidelines-for-using-custom-page-content) to control the load order for CSS and JavaScript.
41-
- Load linked CSS files at the same time as your HTML template so it doesn't 'flicker' between loading the files.
42-
- Control the order in which your `script` tags are fetched and executed before the page load.
43-
- Email field is now `type=email` and mobile keyboards will provide the correct suggestions
44-
- Support for Chrome translate
45-
- Unified and self-asserted pages
46-
- The username/email and password fields now use the `form` HTML element to allow Edge and Internet Explorer (IE) to properly save this information.
47-
- Self-asserted page
48-
- Added a configurable user input validation delay for improved user experience.
49-
50-
## 1.1.0
51-
52-
- Exception page (globalexception)
53-
- Accessibility fix
54-
- Removed the default message when there is no contact from the policy
55-
- Default CSS removed
56-
- MFA page (multifactor)
57-
- 'Confirm Code' button removed
58-
- The input field for the code now only takes input up to six (6) characters
59-
- The page will automatically attempt to verify the code entered when a 6-digit code is entered, without any button having to be clicked
60-
- If the code is wrong, the input field is automatically cleared
61-
- After three (3) attempts with an incorrect code, B2C sends an error back to the relying party
62-
- Accessibility fixes
63-
- Default CSS removed
64-
- Self-asserted page (selfasserted)
65-
- Removed cancel alert
66-
- CSS class for error elements
67-
- Show/hide error logic improved
68-
- Default CSS removed
69-
- Unified SSP (unifiedssp)
70-
- Added keep me signed in (KMSI) control
71-
72-
## 1.0.0
23+
## Self-asserted page (selfasserted)
24+
25+
**2.1.0**
26+
27+
- Localization and accessibility fixes.
28+
29+
**2.0.0**
30+
31+
- Added support for [display controls](display-controls.md) in custom policies.
32+
33+
**1.2.0**
34+
35+
- The username/email and password fields now use the `form` HTML element to allow Edge and Internet Explorer (IE) to properly save this information.
36+
- Added a configurable user input validation delay for improved user experience.
37+
- Accessibility fixes
38+
- You can now add the `data-preload="true"` attribute [in your HTML tags](custom-policy-ui-customization.md#guidelines-for-using-custom-page-content) to control the load order for CSS and JavaScript.
39+
- Load linked CSS files at the same time as your HTML template so it doesn't 'flicker' between loading the files.
40+
- Control the order in which your `script` tags are fetched and executed before the page load.
41+
- Email field is now `type=email` and mobile keyboards will provide the correct suggestions
42+
- Support for Chrome translate
43+
44+
**1.1.0**
45+
46+
- Removed cancel alert
47+
- CSS class for error elements
48+
- Show/hide error logic improved
49+
- Default CSS removed
50+
51+
**1.0.0**
52+
53+
- Initial release
54+
55+
## Unified sign-in sign-up page with password reset link (unifiedssp)
56+
57+
**2.1.0**
58+
59+
- Added support for multiple sign-up links.
60+
- Added support for user input validation according to the predicate rules defined in the policy.
61+
62+
**1.2.0**
63+
64+
- The username/email and password fields now use the `form` HTML element to allow Edge and Internet Explorer (IE) to properly save this information.
65+
- Accessibility fixes
66+
- You can now add the `data-preload="true"` attribute [in your HTML tags](custom-policy-ui-customization.md#guidelines-for-using-custom-page-content) to control the load order for CSS and JavaScript.
67+
- Load linked CSS files at the same time as your HTML template so it doesn't 'flicker' between loading the files.
68+
- Control the order in which your `script` tags are fetched and executed before the page load.
69+
- Email field is now `type=email` and mobile keyboards will provide the correct suggestions
70+
- Support for Chrome translate
71+
72+
**1.1.0**
73+
74+
- Added keep me signed in (KMSI) control
75+
76+
**1.0.0**
77+
78+
- Initial release
79+
80+
## MFA page (multifactor)
81+
82+
**1.2.1**
83+
84+
- Accessibility fixes on default templates
85+
86+
**1.2.0**
87+
88+
- Accessibility fixes
89+
- You can now add the `data-preload="true"` attribute [in your HTML tags](custom-policy-ui-customization.md#guidelines-for-using-custom-page-content) to control the load order for CSS and JavaScript.
90+
- Load linked CSS files at the same time as your HTML template so it doesn't 'flicker' between loading the files.
91+
- Control the order in which your `script` tags are fetched and executed before the page load.
92+
- Email field is now `type=email` and mobile keyboards will provide the correct suggestions
93+
- Support for Chrome translate
94+
95+
**1.1.0**
96+
97+
- 'Confirm Code' button removed
98+
- The input field for the code now only takes input up to six (6) characters
99+
- The page will automatically attempt to verify the code entered when a 6-digit code is entered, without any button having to be clicked
100+
- If the code is wrong, the input field is automatically cleared
101+
- After three (3) attempts with an incorrect code, B2C sends an error back to the relying party
102+
- Accessibility fixes
103+
- Default CSS removed
104+
105+
**1.0.0**
106+
107+
- Initial release
108+
109+
## Exception Page (globalexception)
110+
111+
**1.2.0**
112+
113+
- Accessibility fixes
114+
- You can now add the `data-preload="true"` attribute [in your HTML tags](custom-policy-ui-customization.md#guidelines-for-using-custom-page-content) to control the load order for CSS and JavaScript.
115+
- Load linked CSS files at the same time as your HTML template so it doesn't 'flicker' between loading the files.
116+
- Control the order in which your `script` tags are fetched and executed before the page load.
117+
- Email field is now `type=email` and mobile keyboards will provide the correct suggestions
118+
- Support for Chrome translate
119+
120+
**1.1.0**
121+
122+
- Accessibility fix
123+
- Removed the default message when there is no contact from the policy
124+
- Default CSS removed
125+
126+
**1.0.0**
127+
128+
- Initial release
129+
130+
## Other pages (ProviderSelection, ClaimsConsent, UnifiedSSD)
131+
132+
**1.2.0**
133+
134+
- Accessibility fixes
135+
- You can now add the `data-preload="true"` attribute [in your HTML tags](custom-policy-ui-customization.md#guidelines-for-using-custom-page-content) to control the load order for CSS and JavaScript.
136+
- Load linked CSS files at the same time as your HTML template so it doesn't 'flicker' between loading the files.
137+
- Control the order in which your `script` tags are fetched and executed before the page load.
138+
- Email field is now `type=email` and mobile keyboards will provide the correct suggestions
139+
- Support for Chrome translate
140+
141+
**1.0.0**
73142

74143
- Initial release
75144

‎articles/active-directory/develop/active-directory-certificate-credentials.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ To compute the assertion, you can use one of the many JWT libraries in the langu
3232
| --- | --- |
3333
| `alg` | Should be **RS256** |
3434
| `typ` | Should be **JWT** |
35-
| `x5t` | The X.509 certificate hash (also known as the cert's SHA-1 *thumbprint*) encoded as a Base64 string value. For example, given an X.509 certificate hash of `84E05C1D98BCE3A5421D225B140B36E86A3D5534`, the `x5t` claim would be `hOBcHZi846VCHSJbFAs26Go9VTQ`. |
35+
| `x5t` | The X.509 certificate hash's (also known as the cert's SHA-1 *thumbprint*) Hex representation encoded as a Base64 string value. For example, given an X.509 certificate hash of `84E05C1D98BCE3A5421D225B140B36E86A3D5534` (Hex), the `x5t` claim would be `hOBcHZi846VCHSJbFAs26Go9VTQ=` (Base64). |
3636

3737
### Claims (payload)
3838

‎articles/active-directory/develop/active-directory-claims-mapping.md

Lines changed: 32 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@ author: rwike77
77
manager: CelesteDG
88
ms.service: active-directory
99
ms.subservice: develop
10-
ms.custom: aaddev
10+
ms.custom: aaddev
1111
ms.workload: identity
1212
ms.topic: how-to
13-
ms.date: 08/06/2020
13+
ms.date: 08/25/2020
1414
ms.author: ryanwi
1515
ms.reviewer: paulgarn, hirsin, jeedes, luleon
1616
---
@@ -138,7 +138,6 @@ There are certain sets of claims that define how and when they're used in tokens
138138
| onprem_sid |
139139
| openid2_id |
140140
| password |
141-
| platf |
142141
| polids |
143142
| pop_jwk |
144143
| preferred_username |
@@ -243,11 +242,11 @@ To control what claims are emitted and where the data comes from, use the proper
243242

244243
**Summary:** This property determines whether the basic claim set is included in tokens affected by this policy.
245244

246-
- If set to True, all claims in the basic claim set are emitted in tokens affected by the policy.
245+
- If set to True, all claims in the basic claim set are emitted in tokens affected by the policy.
247246
- If set to False, claims in the basic claim set are not in the tokens, unless they are individually added in the claims schema property of the same policy.
248247

249-
> [!NOTE]
250-
> Claims in the core claim set are present in every token, regardless of what this property is set to.
248+
> [!NOTE]
249+
> Claims in the core claim set are present in every token, regardless of what this property is set to.
251250
252251
### Claims schema
253252

@@ -262,14 +261,14 @@ For each claim schema entry defined in this property, certain information is req
262261

263262
**Value:** The Value element defines a static value as the data to be emitted in the claim.
264263

265-
**Source/ID pair:** The Source and ID elements define where the data in the claim is sourced from.
264+
**Source/ID pair:** The Source and ID elements define where the data in the claim is sourced from.
266265

267266
**Source/ExtensionID pair:** The Source and ExtensionID elements define the directory schema extension attribute where the data in the claim is sourced from. For more information, see [Using directory schema extension attributes in claims](active-directory-schema-extensions.md).
268267

269-
Set the Source element to one of the following values:
268+
Set the Source element to one of the following values:
270269

271-
- "user": The data in the claim is a property on the User object.
272-
- "application": The data in the claim is a property on the application (client) service principal.
270+
- "user": The data in the claim is a property on the User object.
271+
- "application": The data in the claim is a property on the application (client) service principal.
273272
- "resource": The data in the claim is a property on the resource service principal.
274273
- "audience": The data in the claim is a property on the service principal that is the audience of the token (either the client or resource service principal).
275274
- "company": The data in the claim is a property on the resource tenant's Company object.
@@ -344,7 +343,7 @@ The ID element identifies which property on the source provides the value for th
344343

345344
**String:** ClaimsTransformation
346345

347-
**Data type:** JSON blob, with one or more transformation entries
346+
**Data type:** JSON blob, with one or more transformation entries
348347

349348
**Summary:** Use this property to apply common transformations to source data, to generate the output data for claims specified in the Claims Schema.
350349

@@ -363,7 +362,7 @@ Based on the method chosen, a set of inputs and outputs is expected. Define the
363362

364363
**InputClaims:** Use an InputClaims element to pass the data from a claim schema entry to a transformation. It has two attributes: **ClaimTypeReferenceId** and **TransformationClaimType**.
365364

366-
- **ClaimTypeReferenceId** is joined with ID element of the claim schema entry to find the appropriate input claim.
365+
- **ClaimTypeReferenceId** is joined with ID element of the claim schema entry to find the appropriate input claim.
367366
- **TransformationClaimType** is used to give a unique name to this input. This name must match one of the expected inputs for the transformation method.
368367

369368
**InputParameters:** Use an InputParameters element to pass a constant value to a transformation. It has two attributes: **Value** and **ID**.
@@ -415,7 +414,7 @@ Based on the method chosen, a set of inputs and outputs is expected. Define the
415414

416415
A custom signing key must be assigned to the service principal object for a claims mapping policy to take effect. This ensures acknowledgment that tokens have been modified by the creator of the claims mapping policy and protects applications from claims mapping policies created by malicious actors. In order to add a custom signing key, you can use the Azure PowerShell cmdlet `new-azureadapplicationkeycredential` to create a symmetric key credential for your Application object. For more information on this Azure PowerShell cmdlet, see [New-AzureADApplicationKeyCredential](/powerShell/module/Azuread/New-AzureADApplicationKeyCredential?view=azureadps-2.0).
417416

418-
Apps that have claims mapping enabled must validate their token signing keys by appending `appid={client_id}` to their [OpenID Connect metadata requests](v2-protocols-oidc.md#fetch-the-openid-connect-metadata-document). Below is the format of the OpenID Connect metadata document you should use:
417+
Apps that have claims mapping enabled must validate their token signing keys by appending `appid={client_id}` to their [OpenID Connect metadata requests](v2-protocols-oidc.md#fetch-the-openid-connect-metadata-document). Below is the format of the OpenID Connect metadata document you should use:
419418

420419
```
421420
https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration?appid={client-id}
@@ -459,20 +458,20 @@ To get started, do the following steps:
459458
In this example, you create a policy that removes the basic claim set from tokens issued to linked service principals.
460459

461460
1. Create a claims mapping policy. This policy, linked to specific service principals, removes the basic claim set from tokens.
462-
1. To create the policy, run this command:
463-
461+
1. To create the policy, run this command:
462+
464463
``` powershell
465464
New-AzureADPolicy -Definition @('{"ClaimsMappingPolicy":{"Version":1,"IncludeBasicClaimSet":"false"}}') -DisplayName "OmitBasicClaims" -Type "ClaimsMappingPolicy"
466465
```
467466
2. To see your new policy, and to get the policy ObjectId, run the following command:
468-
467+
469468
``` powershell
470469
Get-AzureADPolicy
471470
```
472471
1. Assign the policy to your service principal. You also need to get the ObjectId of your service principal.
473472
1. To see all your organization's service principals, you can [query the Microsoft Graph API](/graph/traverse-the-graph). Or, in [Microsoft Graph Explorer](https://developer.microsoft.com/graph/graph-explorer), sign in to your Azure AD account.
474-
2. When you have the ObjectId of your service principal, run the following command:
475-
473+
2. When you have the ObjectId of your service principal, run the following command:
474+
476475
``` powershell
477476
Add-AzureADServicePrincipalPolicy -Id <ObjectId of the ServicePrincipal> -RefObjectId <ObjectId of the Policy>
478477
```
@@ -482,21 +481,21 @@ In this example, you create a policy that removes the basic claim set from token
482481
In this example, you create a policy that adds the EmployeeID and TenantCountry to tokens issued to linked service principals. The EmployeeID is emitted as the name claim type in both SAML tokens and JWTs. The TenantCountry is emitted as the country/region claim type in both SAML tokens and JWTs. In this example, we continue to include the basic claims set in the tokens.
483482
484483
1. Create a claims mapping policy. This policy, linked to specific service principals, adds the EmployeeID and TenantCountry claims to tokens.
485-
1. To create the policy, run the following command:
486-
484+
1. To create the policy, run the following command:
485+
487486
``` powershell
488487
New-AzureADPolicy -Definition @('{"ClaimsMappingPolicy":{"Version":1,"IncludeBasicClaimSet":"true", "ClaimsSchema": [{"Source":"user","ID":"employeeid","SamlClaimType":"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/employeeid","JwtClaimType":"name"},{"Source":"company","ID":"tenantcountry","SamlClaimType":"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/country","JwtClaimType":"country"}]}}') -DisplayName "ExtraClaimsExample" -Type "ClaimsMappingPolicy"
489488
```
490-
489+
491490
2. To see your new policy, and to get the policy ObjectId, run the following command:
492-
493-
``` powershell
491+
492+
``` powershell
494493
Get-AzureADPolicy
495494
```
496-
1. Assign the policy to your service principal. You also need to get the ObjectId of your service principal.
495+
1. Assign the policy to your service principal. You also need to get the ObjectId of your service principal.
497496
1. To see all your organization's service principals, you can [query the Microsoft Graph API](/graph/traverse-the-graph). Or, in [Microsoft Graph Explorer](https://developer.microsoft.com/graph/graph-explorer), sign in to your Azure AD account.
498-
2. When you have the ObjectId of your service principal, run the following command:
499-
497+
2. When you have the ObjectId of your service principal, run the following command:
498+
500499
``` powershell
501500
Add-AzureADServicePrincipalPolicy -Id <ObjectId of the ServicePrincipal> -RefObjectId <ObjectId of the Policy>
502501
```
@@ -507,20 +506,20 @@ In this example, you create a policy that emits a custom claim "JoinedData" to J
507506
508507
1. Create a claims mapping policy. This policy, linked to specific service principals, adds the EmployeeID and TenantCountry claims to tokens.
509508
1. To create the policy, run the following command:
510-
509+
511510
``` powershell
512511
New-AzureADPolicy -Definition @('{"ClaimsMappingPolicy":{"Version":1,"IncludeBasicClaimSet":"true", "ClaimsSchema":[{"Source":"user","ID":"extensionattribute1"},{"Source":"transformation","ID":"DataJoin","TransformationId":"JoinTheData","JwtClaimType":"JoinedData"}],"ClaimsTransformations":[{"ID":"JoinTheData","TransformationMethod":"Join","InputClaims":[{"ClaimTypeReferenceId":"extensionattribute1","TransformationClaimType":"string1"}], "InputParameters": [{"ID":"string2","Value":"sandbox"},{"ID":"separator","Value":"."}],"OutputClaims":[{"ClaimTypeReferenceId":"DataJoin","TransformationClaimType":"outputClaim"}]}]}}') -DisplayName "TransformClaimsExample" -Type "ClaimsMappingPolicy"
513512
```
514-
515-
2. To see your new policy, and to get the policy ObjectId, run the following command:
516-
513+
514+
2. To see your new policy, and to get the policy ObjectId, run the following command:
515+
517516
``` powershell
518517
Get-AzureADPolicy
519518
```
520-
1. Assign the policy to your service principal. You also need to get the ObjectId of your service principal.
519+
1. Assign the policy to your service principal. You also need to get the ObjectId of your service principal.
521520
1. To see all your organization's service principals, you can [query the Microsoft Graph API](/graph/traverse-the-graph). Or, in [Microsoft Graph Explorer](https://developer.microsoft.com/graph/graph-explorer), sign in to your Azure AD account.
522-
2. When you have the ObjectId of your service principal, run the following command:
523-
521+
2. When you have the ObjectId of your service principal, run the following command:
522+
524523
``` powershell
525524
Add-AzureADServicePrincipalPolicy -Id <ObjectId of the ServicePrincipal> -RefObjectId <ObjectId of the Policy>
526525
```

0 commit comments

Comments
 (0)