Skip to content

Commit c0ac004

Browse files
Banani-RathBanani-Rath
committed
Merging changes synced from https://github.com/MicrosoftDocs/azure-docs-pr (branch live)
2 parents d8b62f4 + 5b25f76 commit c0ac004

File tree

128 files changed

+1381
-1910
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

128 files changed

+1381
-1910
lines changed

‎.openpublishing.redirection.json

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5598,6 +5598,11 @@
55985598
"redirect_url": "/azure/automation/update-management/update-mgmt-view-update-assessments",
55995599
"redirect_document_id": false
56005600
},
5601+
{
5602+
"source_path_from_root": "/articles/best-practices-availability-paired-regions.md",
5603+
"redirect_url": "/azure/availability-zones/cross-region-replication-azure",
5604+
"redirect_document_id": true
5605+
},
56015606
{
56025607
"source_path_from_root": "/articles/availability-zones/index.md",
56035608
"redirect_url": "/azure/availability-zones/az-overview",
@@ -7461,6 +7466,16 @@
74617466
"redirect_url": "/azure/cognitive-services/containers/azure-container-instance-recipe",
74627467
"redirect_document_id": false
74637468
},
7469+
{
7470+
"source_path_from_root": "/articles/cognitive-services/LUIS/luis-csharp-tutorial-bf-v4.md",
7471+
"redirect_url": "/azure/bot-service/bot-builder-howto-v4-luis",
7472+
"redirect_document_id": false
7473+
},
7474+
{
7475+
"source_path_from_root": "/articles/cognitive-services/LUIS/luis-nodejs-tutorial-bf-v4.md",
7476+
"redirect_url": "/azure/bot-service/bot-builder-howto-v4-luis",
7477+
"redirect_document_id": false
7478+
},
74647479
{
74657480
"source_path_from_root": "/articles/cognitive-services/LUIS/migration.md",
74667481
"redirect_url": "/azure/cognitive-services/LUIS/luis-migration-api-v3",

‎CODEOWNERS

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -63,9 +63,6 @@ articles/service-health @rboucher
6363
/articles/container-instances/ @macolso @mimckitt
6464
/articles/container-registry/ @dlepow @mimckitt
6565

66-
# Requires Internal Review
67-
/articles/best-practices-availability-paired-regions.md @martinekuan @syntaxc4 @snoviking
68-
6966
# Governance
7067
/articles/governance/ @DCtheGeek
7168

‎articles/active-directory-b2c/TOC.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,9 @@
256256
href: identity-provider-linkedin.md
257257
- name: Microsoft Account
258258
href: identity-provider-microsoft-account.md
259+
- name: PingOne (PingIdentity)
260+
href: identity-provider-ping-one.md
261+
displayName: Ping identity
259262
- name: QQ
260263
href: identity-provider-qq.md
261264
- name: Salesforce

‎articles/active-directory-b2c/add-identity-provider.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: kengaderdus
66
manager: CelesteDG
77

88
ms.author: kengaderdus
9-
ms.date: 04/29/2021
9+
ms.date: 12/02/2021
1010
ms.custom: mvc
1111
ms.topic: how-to
1212
ms.service: active-directory
@@ -43,6 +43,7 @@ You typically use only one identity provider in your applications, but you have
4343
* [Google](identity-provider-google.md)
4444
* [LinkedIn](identity-provider-linkedin.md)
4545
* [Microsoft Account](identity-provider-microsoft-account.md)
46+
* [PingOne](identity-provider-ping-one.md) (PingIdentity)
4647
* [QQ](identity-provider-qq.md)
4748
* [Salesforce](identity-provider-salesforce.md)
4849
* [Salesforce (SAML protocol)](identity-provider-salesforce-saml.md)

‎articles/active-directory-b2c/identity-provider-ping-one.md

Lines changed: 204 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,204 @@
1+
---
2+
title: Set up sign-up and sign-in with a PingOne account
3+
titleSuffix: Azure AD B2C
4+
description: Provide sign-up and sign-in to customers with PingOne accounts in your applications using Azure Active Directory B2C.
5+
services: active-directory-b2c
6+
author: kengaderdus
7+
manager: CelesteDG
8+
9+
ms.service: active-directory
10+
ms.workload: identity
11+
ms.topic: how-to
12+
ms.date: 12/2/2021
13+
ms.custom: project-no-code
14+
ms.author: kengaderdus
15+
ms.subservice: B2C
16+
zone_pivot_groups: b2c-policy-type
17+
---
18+
19+
# Set up sign-up and sign-in with a PingOne account using Azure Active Directory B2C
20+
21+
[!INCLUDE [active-directory-b2c-choose-user-flow-or-custom-policy](../../includes/active-directory-b2c-choose-user-flow-or-custom-policy.md)]
22+
23+
24+
## Prerequisites
25+
26+
[!INCLUDE [active-directory-b2c-customization-prerequisites](../../includes/active-directory-b2c-customization-prerequisites.md)]
27+
28+
## Create a PingOne application
29+
30+
To enable sign-in for users with a PingOne (PingIdentity) account in Azure Active Directory B2C (Azure AD B2C), you need to create an application in PingIdentity Administrator Console. For more information, see [Add or update an OIDC application](https://docs.pingidentity.com/bundle/pingoneforenterprise/page/agd1564020501024-1.html). If you don't already have a PingOne account, you can sign up at [`https://admin.pingone.com/web-portal/register`](https://admin.pingone.com/web-portal/register).
31+
32+
1. Sign in to the PingIdentity Administrator Console with your PingOne account credentials.
33+
1. In the left menu of the page, select **Connections**, then next to **Applications**, select **+**.
34+
1. On the **New Application** page, select **web app**, then under **OIDC**, select **Configure**.
35+
1. Enter an **Application name**, and select **Next**.
36+
1. For the **Redirect URLs**, enter `https://your-tenant-name.b2clogin.com/your-tenant-name.onmicrosoft.com/oauth2/authresp`. If you use a [custom domain](custom-domain.md), enter `https://your-domain-name/your-tenant-name.onmicrosoft.com/oauth2/authresp`. Replace `your-domain-name` with your custom domain, and `your-tenant-name` with the name of your tenant. Use all lowercase letters when entering your tenant name even if the tenant is defined with uppercase letters in Azure AD B2C.
37+
1. Select **Save and Continue**.
38+
1. Under **SCOPES** select **email**, and **profile**, then select **Save and Continue**.
39+
1. Under **OIDC attributes** page, select **Save and Close**.
40+
1. From the list of applications, select the application you created.
41+
1. In the application **Profile** page, do the following:
42+
1. Next to the application name enable the app using the switch button.
43+
1. Copy the values of **Client ID**.
44+
1. Select the **Configuration** tab, and do the following:
45+
1. Copy the **OIDC discovery endpoint**.
46+
1. Show and copy the **Client secret**.
47+
1. Change the mode to **edit**. Then, under the **Token endpoint authentication method** change the value to **Client Secret Post**, and select **Save**
48+
49+
::: zone pivot="b2c-user-flow"
50+
51+
## Configure PingOne as an identity provider
52+
53+
1. Make sure you're using the directory that contains Azure AD B2C tenant. Select the **Directories + subscriptions** icon in the portal toolbar.
54+
1. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**.
55+
1. Choose **All services** in the top-left corner of the Azure portal, and then search for and select **Azure AD B2C**.
56+
1. Select **Identity providers**, and then select **New OpenID Connect provider**.
57+
1. Enter a **Name**. For example, enter *PingOne*.
58+
1. For **Metadata url**, enter the *OIDC DISCOVERY ENDPOINT* that you previously recorded. For example:
59+
60+
```
61+
https://auth.pingone.eu/00000000-0000-0000-0000-000000000000/as/.well-known/openid-configuration
62+
```
63+
64+
1. For **Client ID**, enter the client ID that you previously recorded.
65+
1. For **Client secret**, enter the client secret that you previously recorded.
66+
1. For **Scope**, enter `openid email profile`.
67+
1. Leave the default values for **Response type**, and **Response mode**.
68+
1. (Optional) For the **Domain hint**, enter `pingone.com`. For more information, see [Set up direct sign-in using Azure Active Directory B2C](direct-signin.md#redirect-sign-in-to-a-social-provider).
69+
1. Under **Identity provider claims mapping**, select the following claims:
70+
71+
- **User ID**: *sub*
72+
- **Display name**: *name*
73+
- **Given name**: *given_name*
74+
- **Surname**: *family_name*
75+
- **Email**: *email*
76+
77+
1. Select **Save**.
78+
79+
## Add PingOne identity provider to a user flow
80+
81+
At this point, the PingOne identity provider has been set up, but it's not yet available in any of the sign-in pages. To add the PingOne identity provider to a user flow:
82+
83+
84+
1. In your Azure AD B2C tenant, select **User flows**.
85+
1. Click the user flow that you want to add the PingOne identity provider.
86+
1. Under the **Social identity providers**, select **PingOne**.
87+
1. Select **Save**.
88+
1. To test your policy, select **Run user flow**.
89+
1. For **Application**, select the web application named *testapp1* that you previously registered. The **Reply URL** should show `https://jwt.ms`.
90+
1. Select the **Run user flow** button.
91+
1. From the sign-up or sign-in page, select **PingOne** to sign in with PingOne account.
92+
93+
If the sign-in process is successful, your browser is redirected to `https://jwt.ms`, which displays the contents of the token returned by Azure AD B2C.
94+
95+
::: zone-end
96+
97+
::: zone pivot="b2c-custom-policy"
98+
99+
## Create a policy key
100+
101+
You need to store the client secret that you previously recorded in your Azure AD B2C tenant.
102+
103+
1. Sign in to the [Azure portal](https://portal.azure.com/).
104+
1. Make sure you're using the directory that contains your Azure AD B2C tenant. Select the **Directories + subscriptions** icon in the portal toolbar.
105+
1. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**.
106+
1. Choose **All services** in the top-left corner of the Azure portal, and then search for and select **Azure AD B2C**.
107+
1. On the Overview page, select **Identity Experience Framework**.
108+
1. Select **Policy Keys** and then select **Add**.
109+
1. For **Options**, choose `Manual`.
110+
1. Enter a **Name** for the policy key. For example, `PingOneSecret`. The prefix `B2C_1A_` is added automatically to the name of your key.
111+
1. In **Secret**, enter your client secret that you previously recorded.
112+
1. For **Key usage**, select `Signature`.
113+
1. Click **Create**.
114+
115+
## Configure PingOne as an identity provider
116+
117+
To enable users to sign in using a PingOne account, you need to define the account as a claims provider that Azure AD B2C can communicate with through an endpoint. The endpoint provides a set of claims that are used by Azure AD B2C to verify that a specific user has authenticated.
118+
119+
You can define a PingOne account as a claims provider by adding it to the **ClaimsProviders** element in the extension file of your policy.
120+
121+
1. Open the *TrustFrameworkExtensions.xml*.
122+
2. Find the **ClaimsProviders** element. If it does not exist, add it under the root element.
123+
3. Add a new **ClaimsProvider** as follows:
124+
125+
```xml
126+
<ClaimsProvider>
127+
<Domain>pingone.com</Domain>
128+
<DisplayName>PingOne</DisplayName>
129+
<TechnicalProfiles>
130+
<TechnicalProfile Id="PingOne-OpenIdConnect">
131+
<DisplayName>Ping Identity</DisplayName>
132+
<Protocol Name="OpenIdConnect" />
133+
<Metadata>
134+
<Item Key="METADATA">Your PingOne OIDC discovery endpoint</Item>
135+
<Item Key="client_id">Your PingOne client ID</Item>
136+
<Item Key="response_types">code</Item>
137+
<Item Key="scope">openid email profile</Item>
138+
<Item Key="HttpBinding">POST</Item>
139+
<Item Key="UsePolicyInRedirectUri">0</Item>
140+
</Metadata>
141+
<CryptographicKeys>
142+
<Key Id="client_secret" StorageReferenceId="B2C_1A_PingOneSecret" />
143+
</CryptographicKeys>
144+
<OutputClaims>
145+
<OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="sub" />
146+
<OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
147+
<OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
148+
<OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="family_name" />
149+
<OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
150+
<OutputClaim ClaimTypeReferenceId="identityProvider" PartnerClaimType="iss" />
151+
<OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" />
152+
</OutputClaims>
153+
<OutputClaimsTransformations>
154+
<OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
155+
<OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
156+
<OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
157+
<OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
158+
</OutputClaimsTransformations>
159+
<UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
160+
</TechnicalProfile>
161+
</TechnicalProfiles>
162+
</ClaimsProvider>
163+
```
164+
165+
4. Set the `METADATA` metadata to your PingOne OIDC discovery endpoint.
166+
5. Set `client_id` metadata to your PingOne client ID.
167+
6. Save the file.
168+
169+
[!INCLUDE [active-directory-b2c-add-identity-provider-to-user-journey](../../includes/active-directory-b2c-add-identity-provider-to-user-journey.md)]
170+
171+
172+
```xml
173+
<OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
174+
<ClaimsProviderSelections>
175+
...
176+
<ClaimsProviderSelection TargetClaimsExchangeId="PingOneExchange" />
177+
</ClaimsProviderSelections>
178+
...
179+
</OrchestrationStep>
180+
181+
<OrchestrationStep Order="2" Type="ClaimsExchange">
182+
...
183+
<ClaimsExchanges>
184+
<ClaimsExchange Id="PingOneExchange" TechnicalProfileReferenceId="PingOne-OpenIdConnect" />
185+
</ClaimsExchanges>
186+
</OrchestrationStep>
187+
```
188+
189+
[!INCLUDE [active-directory-b2c-configure-relying-party-policy](../../includes/active-directory-b2c-configure-relying-party-policy-user-journey.md)]
190+
191+
## Test your custom policy
192+
193+
1. Select your relying party policy, for example `B2C_1A_signup_signin`.
194+
1. For **Application**, select a web application that you [previously registered](tutorial-register-applications.md). The **Reply URL** should show `https://jwt.ms`.
195+
1. Select the **Run now** button.
196+
1. From the sign-up or sign-in page, select **PingOne** to sign in with PingOne account.
197+
198+
If the sign-in process is successful, your browser is redirected to `https://jwt.ms`, which displays the contents of the token returned by Azure AD B2C.
199+
200+
::: zone-end
201+
202+
## Next steps
203+
204+
Learn how to [pass a PingOne token to your application](idp-pass-through-user-flow.md).

0 commit comments

Comments
 (0)