You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/partner-experian.md
+88-94Lines changed: 88 additions & 94 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,21 +4,22 @@ titleSuffix: Azure AD B2C
4
4
description: Learn how to integrate Azure AD B2C authentication with Experian for Identification verification and proofing based on user attributes to prevent fraud.
5
5
services: active-directory-b2c
6
6
author: gargi-sinha
7
-
manager: CelesteDG
7
+
manager: martinco
8
8
ms.reviewer: kengaderdus
9
-
10
9
ms.service: active-directory
11
10
ms.workload: identity
12
11
ms.topic: how-to
13
-
ms.date: 09/13/2022
12
+
ms.date: 12/6/2022
14
13
ms.author: gasinh
15
14
ms.subservice: B2C
16
15
---
17
-
# Tutorial for configuring Experian with Azure Active Directory B2C
16
+
# Tutorial: Configure Experian with Azure Active Directory B2C
17
+
18
+
In this tutorial, learn how to integrate Azure Active Directory B2C (Azure AD B2C) with Experian CrossCore, a service that verifies user identification. It does risk analysis based on information provided by the user during sign-up. CrossCore permits users to sign in, or not.
18
19
19
-
In this sample tutorial, we provide guidance on how to integrate Azure AD B2C with [Experian](https://www.experian.com/decision-analytics/account-opening-fraud/microsoft-integration). Experian provides a variety of solutions, which you can find [here](https://www.experian.com/).
20
+
Learn more about [Experian](https://www.experian.com/decision-analytics/account-opening-fraud/microsoft-integration)solutions, services, etc.
20
21
21
-
In this sample, Experian's integrated digital identity and fraud risk platform **CrossCore** is used. CrossCore is an ID verification service that is used to verify user identification. It does risk analysis based on several pieces of information provided by the user during sign-up flow. CrossCore is used to determine whether the user should be allowed to continue to log in or not. The following attributes can be used in CrossCore risk analysis:
22
+
In this tutorial, you can use the following attributes in CrossCore risk analysis:
22
23
23
24
- Email
24
25
- IP Address
@@ -27,143 +28,136 @@ In this sample, Experian's integrated digital identity and fraud risk platform *
27
28
- Surname
28
29
- Street Address
29
30
- City
30
-
- State/Province
31
+
- State or Province
31
32
- Postal Code
32
-
- Country/Region
33
+
- Country or Region
33
34
- Phone Number
34
35
35
36
## Prerequisites
36
37
37
38
To get started, you'll need:
38
39
39
-
- An Azure AD subscription. If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/).
40
-
41
-
-[An Azure AD B2C tenant](./tutorial-create-tenant.md)that is linked to your Azure subscription.
40
+
- An Azure AD subscription
41
+
- If you don't have one, you can get an [Azure free account](https://azure.microsoft.com/free/)
42
+
-[An Azure AD B2C tenant](./tutorial-create-tenant.md) linked to your Azure subscription
42
43
43
44
## Scenario description
44
45
45
46
The Experian integration includes the following components:
46
47
47
-
- Azure AD B2C – The authorization server, responsible for verifying the user's credentials, also known as the identity provider
48
-
49
-
- Experian – The Experian service takes inputs provided by the user and verifies the user's identity
50
-
51
-
- Custom REST API – This API implements the integration between Azure AD B2C and the Experian service.
48
+
-**Azure AD B2C**: The authorization server that verifies user credentials, also known as the identity provider (IdP)
49
+
-**Experian CrossCore**: The service takes inputs from the user and verifies their identity
50
+
-**Custom REST API**: This implements the integration between Azure AD B2C and CrossCore
52
51
53
52
The following architecture diagram shows the implementation.
54
53
55
-
54
+
56
55
57
-
|Step | Description |
58
-
|:-----| :-----------|
59
-
| 1. | User arrives at a login page. User selects sign-up to create a new account and enters information into the page. Azure AD B2C collects the user attributes.
60
-
| 2. | Azure AD B2C calls the middle layer API and passes on the user attributes.
61
-
| 3. | Middle layer API collects user attributes and transforms it into a format that Experian API could consume. Then, sends it to Experian.
62
-
| 4. | Experian consumes the information and processes it to validate user identification based on the risk analysis. Then, it returns the result to the middle layer API.
63
-
| 5. | Middle layer API processes the information and sends back relevant information in the correct JSON format to Azure AD B2C.
64
-
| 6. | Azure AD B2C receives information back from middle layer API. If it shows a Failure response, an error message is displayed to user. If it shows a Success response, the user is authenticated and written into the directory.
56
+
1. User arrives at sign-in page, creates a new account, and enters information. Azure AD B2C collects user attributes.
57
+
2. Azure AD B2C calls the middle-layer API and passes the user attributes.
58
+
3. Middle-layer API collects user attributes and transforms it into an Experian CrossCore-ready format. Then, sends it to Experian CrossCore.
59
+
4. Experian consumes the information validates user identification based on risk analysis. Then, it returns the result to the middle-layer API.
60
+
5. Middle-layer API processes the information and sends relevant information in a JSON format to Azure AD B2C.
61
+
6. Azure AD B2C receives information from middle-layer API. With a failure, an error message appears. With success, the user is authenticated and written into the directory.
65
62
66
63
## Onboard with Experian
67
64
68
-
1. To create an Experian account, contact [Experian](https://www.experian.com/decision-analytics/account-opening-fraud/microsoft-integration)
69
-
70
-
2. Once an account is created, you'll receive the information you need for API configuration. The following sections describe the process.
65
+
1. Create an Experian account. To get started, go to [Experian](https://www.experian.com/decision-analytics/account-opening-fraud/microsoft-integration) and scroll to the bottom for the contact form.
66
+
2. When an account is created, you receive information for API configuration. The following sections continue the process.
71
67
72
68
## Configure Azure AD B2C with Experian
73
69
74
-
### Part 1 - Deploy the API
70
+
### Deploy the API
75
71
76
-
Deploy the provided [API code](https://github.com/azure-ad-b2c/partner-integrations/blob/master/samples/Experian/CrossCoreIntegrationApi/CrossCoreIntegrationApi.sln) to an Azure service. The code can be published from Visual Studio, following these [instructions](/visualstudio/deployment/quickstart-deploy-to-azure).
72
+
1. Deploy the partner-integration to an Azure service: Go to [/CrossCoreIntegrationApi.sln](https://github.com/azure-ad-b2c/partner-integrations/blob/master/samples/Experian/CrossCoreIntegrationApi/CrossCoreIntegrationApi.sln).
73
+
2. Publish the code from Visual Studio.
77
74
78
75
>[!NOTE]
79
-
>You'll need the URL of the deployed service to configure Azure AD with the required settings.
76
+
>Use the deployed service URL to configure Azure AD with the required settings.
77
+
78
+
### Deploy the client certificate
79
+
80
+
The Experian API call is protected by a client certificate, provided by Experian.
80
81
81
-
### Part 2 - Deploy the client certificate
82
+
1. Follow the instructions in [Private client certificate](../app-service/environment/certificates.md#private-client-certificate).
83
+
2. Upload the certificate to the Azure App service.
82
84
83
-
The Experian API call is protected by a client certificate. This client certificate will be provided by Experian. Following the instructions mentioned in this [document](../app-service/environment/certificates.md#private-client-certificate), the certificate must be uploaded to the Azure App service. The sample policy uses these keys steps in the process:
85
+
The sample policy has two steps:
84
86
85
-
- Upload the certificate
87
+
1. Upload the certificate.
88
+
2. Set the `WEBSITE_LOAD_ROOT_CERTIFICATES` key with the thumbprint of the certificate.
86
89
87
-
- Set the `WEBSITE_LOAD_ROOT_CERTIFICATES` key with the thumbprint of the certificate.
90
+
### Configure the API
88
91
89
-
### Part 3 - Configure the API
92
+
Application settings can be [configured in the App service in Azure](../app-service/configure-common.md#configure-app-settings). Use this method to configure settings without checking them into a repository.
90
93
91
-
Application settings can be [configured in the App service in Azure](../app-service/configure-common.md#configure-app-settings). With this method, settings can be securely configured without checking them into a repository. You'll need to provide the following settings to the REST API:
94
+
Provide the following application settings to the REST API:
| BasicAuth:ApiUsername| Define a username for the API | Used in the ExtId configuration |
105
-
| BasicAuth:ApiPassword | Define a password for the API | Used in the ExtId configuration
106
-
107
-
### Part 4 - Create API policy keys
108
-
109
-
Refer to this [document](./secure-rest-api.md#add-rest-api-username-and-password-policy-keys) and create two policy keys – one for the API username, and one for the API password that you defined above for HTTP basic authentication.
|BasicAuth:ApiUsername| Define a username for the API | Used in the ExtId configuration |
108
+
|BasicAuth:ApiPassword| Define a password for the API | Used in the ExtId configuration|
109
+
110
+
### Create API policy keys
111
+
112
+
Refer to [Custom policy starter pack](./secure-rest-api.md#add-rest-api-username-and-password-policy-keys) to create two policy keys, one each for:
113
+
114
+
* API username
115
+
* API password you defined for HTTP basic authentication
110
116
111
117
>[!NOTE]
112
-
>You'll need the keys for configuring the policies later.
118
+
>Later, you will need the keys for configuring the policies.
113
119
114
-
### Part 5 - Replace the configuration values
120
+
### Replace the configuration values
115
121
116
-
In the provided[custom policies](https://github.com/azure-ad-b2c/partner-integrations/tree/master/samples/Experian/policy), find the following placeholders and replace with the corresponding values from your instance
122
+
In the partner-integration[custom policies](https://github.com/azure-ad-b2c/partner-integrations/tree/master/samples/Experian/policy), find the following placeholders and replace with the corresponding values from your instance
| {your_tenant_name} | Your tenant short name| "yourtenant" from yourtenant.onmicrosoft.com |
121
-
| {your_trustframeworkbase_policy} | Azure AD B2C name of your TrustFrameworkBase policy| B2C_1A_experian_TrustFrameworkBase|
122
-
| {your_tenant_IdentityExperienceFramework_appid} |App ID of the IdentityExperienceFramework app configured in your Azure AD B2C tenant| 01234567-89ab-cdef-0123-456789abcdef|
123
-
| {your_tenant_ProxyIdentityExperienceFramework _appid} | App ID of the ProxyIdentityExperienceFramework app configured in your Azure AD B2C tenant | 01234567-89ab-cdef-0123-456789abcdef|
124
-
| {your_tenant_extensions_appid} | App ID of your tenant's storage application| 01234567-89ab-cdef-0123-456789abcdef|
125
-
| {your_tenant_extensions_app_objectid}| Object ID of your tenant's storage application| 01234567-89ab-cdef-0123-456789abcdef|
126
-
| {your_api_username_key_name}| Name of the username key you created [here](#part-4---create-api-policy-keys)| B2C\_1A\_RestApiUsername|
127
-
| {your_api_password_key_name}| Name of the password key you created [here](#part-4---create-api-policy-keys)| B2C\_1A\_RestApiPassword|
128
-
| {your_app_service_URL}| URL of the app service you've set up|`https://yourapp.azurewebsites.net`|
124
+
|Placeholder|Replace with value|Example |
125
+
| --- | --- | --- |
126
+
| {your_tenant_name} | Your tenant short name | "yourtenant" from yourtenant.onmicrosoft.com |
127
+
| {your_trustframeworkbase_policy} | Azure AD B2C name of your TrustFrameworkBase policy| B2C_1A_experian_TrustFrameworkBase|
128
+
| {your_tenant_IdentityExperienceFramework_appid} |App ID of the IdentityExperienceFramework app configured in your Azure AD B2C tenant| 01234567-89ab-cdef-0123-456789abcdef|
129
+
| {your_tenant_ProxyIdentityExperienceFramework_appid}| App ID of the ProxyIdentityExperienceFramework app configured in your Azure AD B2C tenant | 01234567-89ab-cdef-0123-456789abcdef|
130
+
| {your_tenant_extensions_appid} | App ID of your tenant storage application| 01234567-89ab-cdef-0123-456789abcdef|
131
+
| {your_tenant_extensions_app_objectid}| Object ID of your tenant storage application| 01234567-89ab-cdef-0123-456789abcdef|
132
+
| {your_api_username_key_name}| Username key name, made in **Create API policy keys**| B2C\_1A\_RestApiUsername|
133
+
| {your_api_password_key_name}| Password key name, made in **Create API policy keys**| B2C\_1A\_RestApiPassword|
134
+
| {your_app_service_URL}| App service URL you set up|`https://yourapp.azurewebsites.net`|
129
135
130
-
### Part 6 - Configure the Azure AD B2C policy
136
+
### Configure the Azure AD B2C policy
131
137
132
-
Refer to this [document](./tutorial-create-user-flows.md?pivots=b2c-custom-policy#custom-policy-starter-pack) for instructions on how to set up your Azure AD B2C tenant and configure policies.
138
+
Refer to [Custom policy starter pack](./tutorial-create-user-flows.md?pivots=b2c-custom-policy#custom-policy-starter-pack) for instructions to set up your Azure AD B2C tenant and configure policies.
133
139
134
140
>[!NOTE]
135
-
>This sample policy is based on [Local Accounts starter
>This sample policy is based on [Active Directory B2C custom policy starterpack/LocalAccounts](https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/tree/master/LocalAccounts).
137
142
138
-
>[!NOTE]
139
-
> As a best practice, we recommend that customers add consent notification in the attribute collection page. Notify users that information will be send to third-party services for Identity verification.
143
+
>[!TIP]
144
+
> We recommend that customers add consent notification in the attribute collection page. Notify users that information goes to third-party services for identity verification.
140
145
141
146
## Test the user flow
142
147
143
-
1. Open the Azure AD B2C tenant and under Policies select **User flows**.
144
-
148
+
1. Open the Azure AD B2C tenant and under **Policies** select **User flows**.
145
149
2. Select your previously created **User Flow**.
146
-
147
-
3. Select **Run user flow** and select the settings:
148
-
149
-
a. **Application**: select the registered app (sample is JWT)
150
-
151
-
b. **Reply URL**: select the **redirect URL**
152
-
153
-
c. Select **Run user flow**.
154
-
155
-
4. Go through sign-up flow and create an account
156
-
157
-
5. Log-out
158
-
159
-
6. Go through sign-in flow
160
-
161
-
7. CrossCore puzzle will pop up after you enter **continue**.
150
+
3. Select **Run user flow**.
151
+
4.**Application**: the registered app (example is JWT).
152
+
5.**Reply URL**: **redirect URL**.
153
+
6. Select **Run user flow**.
154
+
7. Complete sign-up flow and create an account.
155
+
8. Sign out.
156
+
9. Complete sign-in flow.
157
+
10. Select **continue**
158
+
11. CrossCore puzzle appears.
162
159
163
160
## Next steps
164
161
165
-
For additional information, review the following articles:
166
-
167
162
-[Custom policies in Azure AD B2C](./custom-policy-overview.md)
168
-
169
163
-[Get started with custom policies in Azure AD B2C](tutorial-create-user-flows.md?pivots=b2c-custom-policy)
0 commit comments