|
1 | 1 | --- |
2 | | -title: Tutorial to configure Azure Active Directory B2C with Nok Nok |
| 2 | +title: Tutorial to configure Nok Nok Passport with Azure Active Directory B2C for passwordless FIDO2 authentication |
3 | 3 | titleSuffix: Azure AD B2C |
4 | | -description: Tutorial to configure Nok Nok with Azure Active Directory B2C to enable passwordless FIDO2 authentication |
| 4 | +description: Configure Nok Nok Passport with Azure AD B2C to enable passwordless FIDO2 authentication |
5 | 5 | services: active-directory-b2c |
6 | 6 | author: gargi-sinha |
7 | | -manager: CelesteDG |
| 7 | +manager: martinco |
8 | 8 | ms.reviewer: kengaderdus |
9 | | - |
10 | 9 | ms.service: active-directory |
11 | 10 | ms.workload: identity |
12 | 11 | ms.topic: how-to |
13 | | -ms.date: 09/20/2021 |
| 12 | +ms.date: 03/13/2023 |
14 | 13 | ms.author: gasinh |
15 | 14 | ms.subservice: B2C |
16 | 15 | --- |
17 | | -# Tutorial: Configure Nok Nok with Azure Active Directory B2C to enable passwordless FIDO2 authentication |
| 16 | +# Tutorial: Configure Nok Nok Passport with Azure Active Directory B2C for passwordless FIDO2 authentication |
18 | 17 |
|
19 | | -In this sample tutorial, learn how to integrate the Nok Nok S3 authentication suite into your Azure Active Directory (AD) B2C tenant. [Nok Nok](https://noknok.com/) enables FIDO certified multifactor authentication such as FIDO UAF, FIDO U2F, WebAuthn, and FIDO2 for mobile and web applications. Using Nok Nok customers can improve their security posture while balancing user experience. |
| 18 | +Learn to integrate the Nok Nok S3 Authentication Suite into your Azure Active Directory B2C (Azure AD B2C) tenant. Nok Nok solutions enable FIDO certified multi-factor authentication such as FIDO UAF, FIDO U2F, WebAuthn, and FIDO2 for mobile and web applications. Nok Nok solutions improve security posture while balancing user experience. |
20 | 19 |
|
21 | | -## Prerequisites |
22 | 20 |
|
23 | | -To get started, you'll need: |
| 21 | +To to noknok.com to learn more: [Nok Nok Labs, Inc.](https://noknok.com/) |
24 | 22 |
|
25 | | -- An Azure subscription. If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/). |
| 23 | +## Prerequisites |
26 | 24 |
|
27 | | -- [An Azure AD B2C tenant](tutorial-create-tenant.md) that is linked to your Azure subscription. |
| 25 | +To get started, you need: |
28 | 26 |
|
29 | | -- Get a free Nok Nok [trial tenant](https://noknok.com/products/strong-authentication-service/). |
| 27 | +* An Azure subscription |
| 28 | + * If you don't have one, get a [Azure free account](https://azure.microsoft.com/free/) |
| 29 | +* An Azure AD B2C tenant linked to the Azure subscription |
| 30 | + * [Tutorial: Create an Azure Active Directory B2C tenant](tutorial-create-tenant.md) |
| 31 | +* Go to [noknok.com](https://noknok.com/products/strong-authentication-service/). On the top menu, select **Demo**. |
30 | 32 |
|
31 | 33 | ## Scenario description |
32 | 34 |
|
33 | | -To enable passwordless FIDO authentication to your users, enable Nok Nok as an Identity provider to your Azure AD B2C tenant. The Nok Nok integration includes the following components: |
34 | | - |
35 | | -- **Azure AD B2C** – The authorization server, responsible for verifying the user’s credentials. |
| 35 | +To enable passwordless FIDO authentication for your users, enable Nok Nok as an identity provider (IdP) in your Azure AD B2C tenant. Nok Nok solution integration includes the following components: |
36 | 36 |
|
37 | | -- **Web and mobile applications** – Your mobile or web applications that you choose to protect with Nok Nok and Azure AD B2C. |
| 37 | +* **Azure AD B2C** – authorization server that verifies user credentials |
| 38 | +* **Web and mobile applications** – mobile or web apps to protect with Nok Nok solutions and Azure AD B2C |
| 39 | +* **Nok Nok app SDK or Passport app** – authenticate Azure AD B2C enabled applications. |
| 40 | + * Go to the Apple App Store for [Nok Nok Passport](https://apps.apple.com/us/app/nok-nok-passport/id1050437340) |
| 41 | + * Or, Google Play [Nok Nok Passport](https://play.google.com/store/apps/details?id=com.noknok.android.passport2&hl=en&gl=US) |
38 | 42 |
|
39 | | -- **The Nok Nok app SDK or Nok Nok Passport app** – Applications used to authenticate Azure AD B2C enabled applications. These applications are available on [Apple app store](https://apps.apple.com/us/app/nok-nok-passport/id1050437340) and [Google play store](https://play.google.com/store/apps/details?id=com.noknok.android.passport2&hl=en&gl=US). |
| 43 | +The following diagram illustrates the Nok Nok solution as IdP for Azure AD B2C using Open ID Connect (OIDC) for passwordless authentication. |
40 | 44 |
|
41 | | -The following architecture diagram shows the implementation. Nok Nok is acting as an Identity provider for Azure AD B2C using Open ID Connect (OIDC) to enable passwordless authentication. |
| 45 | +  |
42 | 46 |
|
43 | | - |
| 47 | +1. At the sign-in page, user selects sign-in or sign-up and enters the username. |
| 48 | +2. Azure AD B2C redirects user to the Nok Nok OIDC authentication provider. |
| 49 | +3. For mobile authentications, a QR code appears or push notification goes to the user device. For desktop sign-in, the user is redirected to the web app sign-in page for passwordless authentication. |
| 50 | +4. User scans the QR code with Nok Nok app SDK or Passport app. Or, username is sign-in page input. |
| 51 | +5. User is prompted for authentication. User does passwordless authentication: biometrics, device PIN, or any roaming authenticator. Authentication prompt appears on web application. User does passwordless authentication: biometrics, device PIN, or any roaming authenticator. |
| 52 | +6. Nok Nok server validates FIDO assertion and sends OIDC authentication response to Azure AD B2C. |
| 53 | +7. User is granted or denied access. |
44 | 54 |
|
45 | | -| Step | Description | |
46 | | -|:------|:-----------| |
47 | | -| 1. | User arrives at a login page. Users select sign-in/sign-up and enter the username | |
48 | | -| 2. | Azure AD B2C redirects the user to the Nok Nok OIDC authentication provider. | |
49 | | -| 3a. | For mobile based authentications, Nok Nok either displays a QR code or sends a push notification request to the end user’s mobile device. | |
50 | | -| 3b. | For Desktop/PC based login, Nok Nok redirects the end user to the web application login page to initiate a passwordless authentication prompt. | |
51 | | -|4a. | The user scan’s the displayed QR code in their smartphone using Nok Nok app SDK or Nok Nok Passport app.| |
52 | | -| 4b. | User provides username as an input on the login page of the web application and selects next. | |
53 | | -| 5a. | User is prompted for authentication on smartphone. <BR> User does passwordless authentication by using the user’s preferred method, such as biometrics, device PIN, or any roaming authenticator.| |
54 | | -| 5b. | User is prompted for authentication on web application. <BR> User does passwordless authentication by using the user’s preferred method, such as biometrics, device PIN, or any roaming authenticator. | |
55 | | -| 6. | Nok Nok server validates FIDO assertion and upon validation, sends OIDC authentication response to Azure AD B2C.| |
56 | | -| 7. | Based on the response user is granted or denied access. | |
| 55 | +## Get started with Nok Nok |
57 | 56 |
|
58 | | -## Onboard with Nok Nok |
59 | | - |
60 | | -Fill out the [Nok Nok cloud form](https://noknok.com/contact/) to create your own Nok Nok tenant. Once you submit the form, you'll receive an email explaining how to access your tenant. The email will also include access to Nok Nok guides. Follow the instructions provided in the Nok Nok integration guide to complete the OIDC configuration of your Nok Nok cloud tenant. |
| 57 | +1. Go to the noknok.com [Contact](https://noknok.com/contact/) page. |
| 58 | +2. Fill out the form for a Nok Nok tenant. |
| 59 | +3. An email arrives with tenant access information and links to documentation. |
| 60 | +4. Use the Nok Nok integration documentation to complete the tenant OIDC configuration. |
61 | 61 |
|
62 | 62 | ## Integrate with Azure AD B2C |
63 | 63 |
|
| 64 | +Use the following instructions to add and configure an IdP then configure a user flow. |
| 65 | + |
64 | 66 | ### Add a new Identity provider |
65 | 67 |
|
66 | | -To add a new Identity provider, follow these steps: |
| 68 | +For the following instructions, use the directory with the Azure AD B2C tenant. To add a new IdP: |
67 | 69 |
|
68 | | -1. Sign in to the **[Azure portal](https://portal.azure.com/#home)** as the global administrator of your Azure AD B2C tenant. |
69 | | -1. Make sure you're using the directory that contains your Azure AD B2C tenant. Select the **Directories + subscriptions** icon in the portal toolbar. |
70 | | -1. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**. |
71 | | -1. Choose **All services** in the top-left corner of the Azure portal, search for and select **Azure AD B2C**. |
72 | | -1. Navigate to **Dashboard** > **Azure Active Directory B2C** > **Identity providers** |
73 | | -1. Select **Identity providers**. |
74 | | -1. Select **Add**. |
| 70 | +1. Sign in to the **[Azure portal](https://portal.azure.com/#home)** as Global Administrator of the Azure AD B2C tenant. |
| 71 | +2. In the portal toolbar, select the **Directories + subscriptions**. |
| 72 | +3. On **Portal settings, Directories + subscriptions**, in the **Directory name** list, locate the Azure AD B2C directory. |
| 73 | +4. Select **Switch**. |
| 74 | +5. In the top-left corner of the Azure portal, select **All services**. |
| 75 | +6. Search for and select **Azure AD B2C**. |
| 76 | +7. Navigate to **Dashboard** > **Azure Active Directory B2C** > **Identity providers**. |
| 77 | +8. Select **Identity providers**. |
| 78 | +9. Select **Add**. |
75 | 79 |
|
76 | 80 | ### Configure an Identity provider |
77 | 81 |
|
78 | | -To configure an Identity provider, follow these steps: |
79 | | - |
80 | | -1. Select **Identity provider type** > **OpenID Connect (Preview)** |
81 | | -1. Fill out the form to set up the Identity provider: |
82 | | - |
83 | | - |Property | Value | |
84 | | - |:-----| :-----------| |
85 | | - | Name | Nok Nok Authentication Provider | |
86 | | - | Metadata URL | Insert the URI of the hosted Nok Nok Authentication app, followed by the specific path such as 'https://demo.noknok.com/mytenant/oidc/.well-known/openid-configuration' | |
87 | | - | Client Secret | Use the client Secret provided by the Nok Nok platform.| |
88 | | - | Client ID | Use the client ID provided by the Nok Nok platform.| |
89 | | - | Scope | OpenID profile email | |
90 | | - | Response type | code | |
91 | | - | Response mode | form_post| |
92 | | - |
93 | | -1. Select **OK**. |
94 | | - |
95 | | -1. Select **Map this identity provider’s claims**. |
96 | | - |
97 | | -1. Fill out the form to map the Identity provider: |
98 | | - |
99 | | - |Property | Value | |
100 | | - |:-----| :-----------| |
101 | | - | UserID | From subscription | |
102 | | - | Display name | From subscription | |
103 | | - | Response mode | From subscription | |
104 | | - |
105 | | -1. Select **Save** to complete the setup for your new OIDC Identity provider. |
| 82 | +To configure an IdP: |
| 83 | + |
| 84 | +1. Select **Identity provider type** > **OpenID Connect (Preview)**. |
| 85 | +2. For **Name**, enter Nok Nok Authentication Provider, or another name. |
| 86 | +3. For **Metadata URL**, enter hosted Nok Nok Authentication app URI, followed by the path such as `https://demo.noknok.com/mytenant/oidc/.well-known/openid-configuration` |
| 87 | +4. For **Client Secret**, use the Client Secret from Nok Nok. |
| 88 | +5. For **Client ID**, use the client ID provided by Nok Nok. |
| 89 | +6. For **Scope**, use **OpenID profile email**. |
| 90 | +7. For **Response type**, use **code**. |
| 91 | +8. For **Response mode**, use **form_post**. |
| 92 | +9. Select **OK**. |
| 93 | +10. Select **Map this identity provider’s claims**. |
| 94 | +11. For **UserID**, select **From subscription**. |
| 95 | +12. For **Display name**, select **From subscription**. |
| 96 | +13. For **Response mode**, select **From subscription**. |
| 97 | +14. Select **Save**. |
106 | 98 |
|
107 | 99 | ### Create a user flow policy |
108 | 100 |
|
109 | | -You should now see Nok Nok as a new OIDC Identity provider listed within your B2C identity providers. |
| 101 | +For the following instructions, Nok Nok is a new OIDC IdP in the B2C identity providers list. |
110 | 102 |
|
111 | 103 | 1. In your Azure AD B2C tenant, under **Policies**, select **User flows**. |
112 | | - |
113 | | -2. Select **New** user flow. |
114 | | - |
115 | | -3. Select **Sign up and sign in**, select a **version**, and then select **Create**. |
116 | | - |
117 | | -4. Enter a **Name** for your policy. |
118 | | - |
119 | | -5. In the Identity providers section, select your newly created Nok Nok Identity provider. |
120 | | - |
121 | | -6. Set up the parameters of your User flow. Insert a name and select the Identity provider you’ve created. You can also add email address. In this case, Azure won’t redirect the login procedure directly to Nok Nok instead it will show a screen where the user can choose the option they would like to use. |
122 | | - |
123 | | -7. Leave the **Multi-factor Authentication** field as is. |
124 | | - |
125 | | -8. Select **Enforce conditional access policies** |
126 | | - |
127 | | -9. Under **User attributes and token claims**, select **Email Address** in the Collect attribute option. You can add all the attributes that Azure AD can collect about the user alongside the claims that Azure AD B2C can return to the client application. |
128 | | - |
129 | | -10. Select **Create**. |
130 | | - |
131 | | -11. After a successful creation, select your new **User flow**. |
132 | | - |
133 | | -12. On the left panel, select **Application Claims**. Under options, tick the **email** checkbox and select **Save**. |
| 104 | +2. Select **New**. |
| 105 | +3. Select **Sign up and sign in**. |
| 106 | +4. Select a **version**. |
| 107 | +5. Select **Create**. |
| 108 | +6. Enter a policy **Name**. |
| 109 | +7. In **Identity providers**, select the created Nok Nok IdP. |
| 110 | +8. You can add an email address. Azure won't redirect sign-in to Nok Nok; a screen appears with user options. |
| 111 | +9. Leave the **Multi-factor Authentication** field. |
| 112 | +10. Select **Enforce conditional access policies**. |
| 113 | +11. Under **User attributes and token claims**, in the Collect attribute option, select **Email Address**. |
| 114 | +12. Add user attributes for Azure AD to collect, with claims that Azure AD B2C returns to the client application. |
| 115 | +13. Select **Create**. |
| 116 | +14. Select the new **User flow**. |
| 117 | +15. On the left panel, select **Application Claims**. |
| 118 | +16. Under options, select the **email** checkbox |
| 119 | +17. Select **Save**. |
134 | 120 |
|
135 | 121 | ## Test the user flow |
136 | 122 |
|
137 | | -1. Open the Azure AD B2C tenant and under Policies select Identity Experience Framework. |
| 123 | +1. Open the Azure AD B2C tenant and under **Policies** select **Identity Experience Framework**. |
| 124 | +2. Select the created **SignUpSignIn**. |
| 125 | +3. Select **Run user flow**. |
| 126 | +4. For **Application**, select the registered app. The example is JWT. |
| 127 | +5. For **Reply URL**, select the redirect URL. |
| 128 | +6. Select **Run user flow**. |
| 129 | +7. Perform a sign-up flow and create an account. |
| 130 | +8. After the user attribute is created, Nok Nok is called. |
138 | 131 |
|
139 | | -2. Select your previously created SignUpSignIn. |
140 | | - |
141 | | -3. Select Run user flow and select the settings: |
142 | | - |
143 | | - a. Application: select the registered app (sample is JWT) |
144 | | - |
145 | | - b. Reply URL: select the redirect URL |
146 | | - |
147 | | - c. Select Run user flow. |
148 | | - |
149 | | -4. Go through sign-up flow and create an account |
150 | | - |
151 | | -5. Nok Nok will be called during the flow, after user attribute is created. If the flow is incomplete, check that user isn't saved in the directory. |
| 132 | +If the flow is incomplete, confirm the user is or isn't saved in the directory. |
152 | 133 |
|
153 | 134 | ## Next steps |
154 | 135 |
|
155 | | -For additional information, review the following articles: |
156 | | - |
157 | | -- [Custom policies in Azure AD B2C](./custom-policy-overview.md) |
158 | | - |
159 | | -- [Get started with custom policies in Azure AD B2C](tutorial-create-user-flows.md?pivots=b2c-custom-policy) |
| 136 | +* [Azure AD B2C custom policy overview](./custom-policy-overview.md) |
| 137 | +* [Tutorial: Create user flows and custom policies in Azure Active Directory B2C](tutorial-create-user-flows.md?pivots=b2c-custom-policy) |
0 commit comments