Skip to content

Commit cd77b63

Browse files
Court72Court72
authored
Merge pull request #220932 from v-edmckillop/patch-41
Update partner-onfido.md
2 parents f352e35 + 4ba2491 commit cd77b63

File tree

1 file changed

+83
-92
lines changed

1 file changed

+83
-92
lines changed

‎articles/active-directory-b2c/partner-onfido.md

Lines changed: 83 additions & 92 deletions
Original file line numberDiff line numberDiff line change
@@ -4,167 +4,158 @@ titleSuffix: Azure AD B2C
44
description: Learn how to integrate Azure AD B2C authentication with Onfido for document ID and facial biometrics verification
55
services: active-directory-b2c
66
author: gargi-sinha
7-
manager: CelesteDG
7+
manager: martinco
88
ms.reviewer: kengaderdus
99
ms.service: active-directory
1010
ms.workload: identity
1111
ms.topic: how-to
12-
ms.date: 08/03/2020
12+
ms.date: 12/8/2022
1313
ms.author: gasinh
1414
ms.subservice: B2C
1515
---
1616

1717
# Tutorial for configuring Onfido with Azure Active Directory B2C
1818

19-
In this sample tutorial, we provide guidance on how to integrate Azure AD B2C with [Onfido](https://onfido.com/). Onfido is a document ID and facial biometrics verification app. It allows companies to meet *Know Your Customer* and identity requirements in real time. Onfido uses sophisticated AI-based identity verification, which first verifies a photo ID, then matches it against their facial biometrics. This solution ties a digital identity to their real-world person and provides a safe onboarding experience while reducing fraud.
19+
In this tutorial, learn how to integrate Azure Active Directory B2C (Azure AD B2C) with [Onfido](https://onfido.com/), a document ID and facial biometrics verification app. Use it to meet *Know Your Customer* and identity requirements. Onfido uses artificial intelligence (AI) technology that verifies identity by matching a photo ID with facial biometrics. The solution connects a digital identity to a person, provides a reliable onboarding experience, and helps reduce fraud.
2020

21-
In this sample, we connect Onfido's service in the sign-up or login flow to do identity verification. Informed decisions about which product and service the user can access is made based on Onfido's results.
21+
In this tutorial, you'll enable the Onfido service to verify identity in the sign-up, or sign-in, flow. Onfido results inform decisions about which products or services the user accesses.
2222

2323
## Prerequisites
2424

2525
To get started, you'll need:
2626

27-
- An Azure AD subscription. If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/).
28-
29-
- [An Azure AD B2C tenant](./tutorial-create-tenant.md) that is linked to your Azure subscription.
30-
31-
- An Onfido [trial account](https://onfido.com/signup/).
27+
- An Azure AD subscription
28+
- If you don't have on, you can get an [Azure free account](https://azure.microsoft.com/free/)
29+
- [An Azure AD B2C tenant](./tutorial-create-tenant.md) linked to your Azure subscription
30+
- An Onfido trial account
31+
- Go to onfido.com [Contact us](https://onfido.com/signup/) and fill out the form
3232

3333
## Scenario description
3434

3535
The Onfido integration includes the following components:
3636

37-
- Azure AD B2C tenant – The authorization server, responsible for verifying the user's credentials based on custom policies defined in the tenant. It's also known as the identity provider. It hosts the Onfido client app, which collects the user documents and transmits it to the Onfido API service.
37+
- **Azure AD B2C tenant** – The authorization server that verifies user credentials based on custom policies defined in the tenant. It's also known as the identity provider (IdP). It hosts the Onfido client app, which collects the user documents and transmits them to the Onfido API service.
38+
- **Onfido client** – A configurable, JavaScript client document-collection utility deployed in webpages. It checks details such as document size and quality.
39+
- **Intermediate REST API** – Provides endpoints for the Azure AD B2C tenant to communicate with the Onfido API service. It handles data processing and adheres to security requirements of both.
40+
- **Onfido API service** – The back-end service, which saves and verifies user documents.
3841

39-
- Onfido client – A configurable JavaScript client document collection utility deployed within other webpages. Collects the documents and does preliminary checks like document size and quality.
42+
The following architecture diagram shows the implementation.
4043

41-
- Intermediate REST API – Provides endpoints for the Azure AD B2C tenant to communicate with the Onfido API service, handling data processing and adhering to the security requirements of both.
44+
![Onfido architecture diagram.](media/partner-onfido/onfido-architecture-diagram.png)
4245

43-
- Onfido API service – The backend service provided by Onfido, which saves and verifies the documents provided by the user.
4446

45-
The following architecture diagram shows the implementation.
47+
1. User signs up to create a new account and enters attributes. Azure AD B2C collects the attributes. Onfido client app hosted in Azure AD B2C checks for the user information.
48+
2. Azure AD B2C calls the middle layer API and passes the attributes.
49+
3. Middle layer API collects attributes and converts them to an Onfido API format.
50+
4. Onfido processes attributes to validate user identification and sends result to the middle layer API.
51+
5. Middle layer API processes the results and sends relevant information to Azure AD B2C, in JavaScript Object Notation (JSON) format.
52+
6. Azure AD B2C receives the information. If the response fails, an error message appears. If the response succeeds, the user is authenticated and written into the directory.
4653

47-
![screenshot for onfido-architecture-diagram](media/partner-onfido/onfido-architecture-diagram.png)
54+
## Create an Onfido account
4855

49-
|Step | Description |
50-
|:-----| :-----------|
51-
| 1. | User arrives at a login page. User signs-up to create a new account and enters information into the page. Azure AD B2C collects the user attributes. Onfido client app hosted in Azure AD B2C does preliminary checks for the user information.
52-
| 2. | Azure AD B2C calls the middle layer API and passes on the user attributes.
53-
| 3. | Middle layer API collects user attributes and transforms it into a format that Onfido API could consume. Then, sends it to Onfido.
54-
| 4. | Onfido consumes the information and processes it to validate user identification. Then, it returns the result to the middle layer API.
55-
| 5. | Middle layer API processes the information and sends back relevant information in the correct JSON format to Azure AD B2C.
56-
| 6. | Azure AD B2C receives information back from middle layer API. If it shows a Failure response, an error message is displayed to user. If it shows a Success response, the user is authenticated and written into the directory.
56+
1. Create an Onfido account: go to onfido.com [Contact us](https://onfido.com/signup/) and fill out the form.
57+
2. Create an API key: go to [Get started (API v3.5)](https://documentation.onfido.com/).
5758

58-
## Onboard with Onfido
59+
>[!NOTE]
60+
> You'll need the key later.
5961
60-
1. To create an Onfido account, contact [Onfido](https://onfido.com/signup/).
62+
### Onfido documentation
6163

62-
2. Once an account is created, create an [API key](https://documentation.onfido.com/). Live keys are billable, however, you can use the [sandbox keys for testing](https://documentation.onfido.com/?javascript#sandbox-and-live-differences) the solution. The sandbox keys produce the same result structure as live keys, however, the results are always predetermined. Documents aren't processed or saved.
64+
Live keys are billable, however, you can use the sandbox keys for testing. Go to onfido.com for, [Sandbox and live differences](https://documentation.onfido.com/?javascript#sandbox-and-live-differences). The sandbox keys produce the same result structure as live keys, however, results are predetermined. Documents aren't processed or saved.
6365

64-
>[!NOTE]
65-
> You will need the key later.
66+
For more Onfido documentation, see:
6667

67-
For more information about Onfido, see [Onfido API documentation](https://documentation.onfido.com) and [Onfido Developer Hub](https://developers.onfido.com).
68+
* [Onfido API documentation](https://documentation.onfido.com)
69+
* [Onfido Developer Hub](https://developers.onfido.com)
6870

6971
## Configure Azure AD B2C with Onfido
7072

71-
### Part 1 - Deploy the API
73+
### Deploy the API
7274

73-
- Deploy the provided [API code](https://github.com/azure-ad-b2c/partner-integrations/tree/master/samples/OnFido-Combined/API/Onfido.Api) to an Azure service. The code can be published from Visual Studio, following these [instructions](/visualstudio/deployment/quickstart-deploy-to-azure).
74-
- Set-up CORS, add **Allowed Origin** as https://{your_tenant_name}.b2clogin.com
75+
1. Deploy the API code to an Azure service. Go to [samples/OnFido-Combined/API/Onfido.Api/](https://github.com/azure-ad-b2c/partner-integrations/tree/master/samples/OnFido-Combined/API/Onfido.Api). You can publish the code from Visual Studio.
76+
2. Set up cross-origin resource sharing (CORS).
77+
3. Add **Allowed Origin** as `https://{your_tenant_name}.b2clogin.com`.
7578

7679
>[!NOTE]
77-
>You'll need the URL of the deployed service to configure Azure AD with the required settings.
80+
>You'll need the deployed service URL to configure Azure AD.
7881
7982
#### Adding sensitive configuration settings
8083

81-
Application settings can be configured in the [App service in Azure](../app-service/configure-common.md#configure-app-settings). The App service allows for settings to be securely configured without checking them into a repository. The REST API needs the following settings:
84+
[Configure app settings](../app-service/configure-common.md#configure-app-settings) in the Azure App service without checking them into a repository.
8285

83-
| Application setting name | Source | Notes |
84-
|:-------------------------|:-------|:-------|
85-
|OnfidoSettings:AuthToken| Onfido Account |
86+
REST API settings:
8687

87-
### Part 2 - Deploy the UI
88+
* **Application setting name**: OnfidoSettings:AuthToken
89+
* **Source**: Onfido Account
8890

89-
#### Configure your storage location
91+
### Deploy the UI
9092

91-
1. Set up a [blob storage container in your storage account](../storage/blobs/storage-quickstart-blobs-portal.md#create-a-container)
92-
93-
2. Store the UI files from the [UI folder](https://github.com/azure-ad-b2c/partner-integrations/tree/master/samples/OnFido-Combined/UI) to your blob container.
94-
95-
3. Allow CORS access to storage container you created by following these instructions:
96-
97-
a. Go to **Settings** >**Allowed Origin**, enter `https://{your_tenant_name}.b2clogin.com`. Replace your-tenant-name with the name of your Azure AD B2C tenant. For example, https://fabrikam.b2clogin.com. Use all lowercase letters when entering your tenant name.
98-
99-
b. For **Allowed Methods**, select `GET` and `PUT`.
93+
#### Configure your storage location
10094

101-
c. Select **Save**.
95+
1. In the Azure portal, [create a container](../storage/blobs/storage-quickstart-blobs-portal.md#create-a-container).
96+
2. Store the UI files in [/samples/OnFido-Combined/UI](https://github.com/azure-ad-b2c/partner-integrations/tree/master/samples/OnFido-Combined/UI), in your blob container.
97+
3. Allow CORS access to the storage container you created: Go to **Settings** >**Allowed Origin**.
98+
4. Enter `https://{your_tenant_name}.b2clogin.com`.
99+
5. Replace your tenant name with your Azure AD B2C tenant name, using lower-case letters. For example, `https://fabrikam.b2clogin.com`.
100+
6. For **Allowed Methods**, select `GET` and `PUT`.
101+
7. Select **Save**.
102102

103103
#### Update UI files
104104

105-
1. In the UI files, go to the folder [**ocean_blue**](https://github.com/azure-ad-b2c/partner-integrations/tree/master/samples/OnFido-Combined/UI/ocean_blue)
106-
105+
1. In the UI files, go to [samples/OnFido-Combined/UI/ocean_blue](https://github.com/azure-ad-b2c/partner-integrations/tree/master/samples/OnFido-Combined/UI/ocean_blue).
107106
2. Open each html file.
108-
109-
3. Find and replace `{your-ui-blob-container-url}` with the URL of where your UI **ocean_blue**, **dist**, and **assets** folders are located
110-
111-
4. Find and replace `{your-intermediate-api-url}` with the URL of the intermediate API app service.
107+
3. Find `{your-ui-blob-container-url}`, and replace it with your UI **ocean_blue**, **dist**, and **assets** folder URLs.
108+
4. Find `{your-intermediate-api-url}`, and replace it with the intermediate API app service URL.
112109

113110
#### Upload your files
114111

115-
1. Store the UI files from the UI folder to your blob container.
116-
117-
2. Use [Azure Storage Explorer](../virtual-machines/disks-use-storage-explorer-managed-disks.md) to manage your files and access permissions.
112+
1. Store the UI folder files in your blob container.
113+
2. [Use Azure Storage Explorer to manage Azure managed disks](../virtual-machines/disks-use-storage-explorer-managed-disks.md) and access permissions.
118114

119-
### Part 3 - Configure Azure AD B2C
115+
### Configure Azure AD B2C
120116

121117
#### Replace the configuration values
122118

123-
In the provided [custom policies](https://github.com/azure-ad-b2c/partner-integrations/tree/master/samples/OnFido-Combined/Policies), find the following placeholders and replace with the corresponding values from your instance.
119+
In [/samples/OnFido-Combined/Policies](https://github.com/azure-ad-b2c/partner-integrations/tree/master/samples/OnFido-Combined/Policies), find the following placeholders and replace them with the corresponding values from your instance.
124120

125-
| Placeholder | Replace with value | Example |
126-
|:---------------|:----------------|:-------------------|
127-
| {your_tenant_name} | Your tenant short name | "yourtenant" from yourtenant.onmicrosoft.com |
128-
| {your_tenantID} | TenantID of your Azure AD B2C tenant | 01234567-89ab-cdef-0123-456789abcdef |
129-
| {your_tenant_IdentityExperienceFramework_appid} | App ID of the IdentityExperienceFramework app configured in your Azure AD B2C tenant | 01234567-89ab-cdef-0123-456789abcdef |
130-
| {your_tenant_ ProxyIdentityExperienceFramework _appid} | App ID of the ProxyIdentityExperienceFramework app configured in your Azure AD B2C tenant | 01234567-89ab-cdef-0123-456789abcdef |
131-
| {your_tenant_extensions_appid} | App ID of your tenant's storage application | 01234567-89ab-cdef-0123-456789abcdef |
132-
| {your_tenant_extensions_app_objectid} | Object ID of your tenant's storage application | 01234567-89ab-cdef-0123-456789abcdef |
133-
| {your_app_insights_instrumentation_key} | Instrumentation key of your app insights instance*| 01234567-89ab-cdef-0123-456789abcdef|
134-
|{your_ui_file_base_url}| URL of the location where your UI **ocean_blue**, **dist**, and **assets** folders are located | https://yourstorage.blob.core.windows.net/UI/|
135-
| {your_app_service_URL} | URL of the app service you've set up | `https://yourapp.azurewebsites.net` |
121+
|Placeholder|Replace with value|Example|
122+
|---|---|---|
123+
|{your_tenant_name}|Your tenant short name|"your tenant" from yourtenant.onmicrosoft.com|
124+
|{your_tenantID}|Your Azure AD B2C TenantID| 01234567-89ab-cdef-0123-456789abcdef|
125+
|{your_tenant_IdentityExperienceFramework_appid}|IdentityExperienceFramework app App ID configured in your Azure AD B2C tenant|01234567-89ab-cdef-0123-456789abcdef|
126+
|{your_tenant_ ProxyIdentityExperienceFramework_appid}|ProxyIdentityExperienceFramework app App ID configured in your Azure AD B2C tenant| 01234567-89ab-cdef-0123-456789abcdef|
127+
|{your_tenant_extensions_appid}|Your tenant storage application App ID| 01234567-89ab-cdef-0123-456789abcdef|
128+
|{your_tenant_extensions_app_objectid}|Your tenant storage application Object ID| 01234567-89ab-cdef-0123-456789abcdef|
129+
|{your_app_insights_instrumentation_key}|Your app insights instance* instrumentation key|01234567-89ab-cdef-0123-456789abcdef|
130+
|{your_ui_file_base_url}|Location URL of your UI folders **ocean_blue**, **dist**, and **assets**| `https://yourstorage.blob.core.windows.net/UI/`|
131+
|{your_app_service_URL}|The app service URL you set up|`https://yourapp.azurewebsites.net`|
136132

137-
*App insights can be in a different tenant. This step is optional. Remove the corresponding TechnicalProfiles and OrchestrationSteps if not needed.
133+
*App insights can be in a different tenant. This step is optional. Remove the corresponding TechnicalProfiles and OrchestrationSteps, if they're not needed.
138134

139-
### Part 4 - Configure the Azure AD B2C policy
135+
### Configure Azure AD B2C policy
140136

141-
Refer to this [document](tutorial-create-user-flows.md?pivots=b2c-custom-policy#custom-policy-starter-pack) for instructions on how to set up your Azure AD B2C tenant and configure policies.
137+
See, [Custom policy starter pack](tutorial-create-user-flows.md?pivots=b2c-custom-policy#custom-policy-starter-pack) for instructions to set up your Azure AD B2C tenant and configure policies. Custom policies are a set of XML files you upload to your Azure AD B2C tenant to define technical profiles and user journeys.
142138

143139
>[!NOTE]
144-
> As a best practice, we recommend that customers add consent notification in the attribute collection page. Notify users that information will be send to third-party services for Identity verification.
140+
>We recommend you add consent notification on the attribute collection page. Notify users that information goes to third-party services for identity verification.
145141
146142
## Test the user flow
147143

148-
1. Open the Azure AD B2C tenant and under Policies select **Identity Experience Framework**.
149-
150-
2. Select your previously created **SignUpSignIn**.
151-
152-
3. Select **Run user flow** and select the settings:
153-
154-
a. **Application**: select the registered app (sample is JWT)
144+
1. Open the Azure AD B2C tenant.
145+
2. Under **Policies** select **Identity Experience Framework**.
146+
3. Select your previously created **SignUpSignIn**.
147+
4. Select **Run user flow**.
148+
5. For **Application**, select the registered app (example is JWT).
149+
6. For **Reply URL**, select the **redirect URL**.
150+
7. Select **Run user flow**.
151+
8. Complete the sign-up flow.
152+
9. Create an account.
153+
10. When the user attribute is created, Onfido is called during the flow.
155154

156-
b. **Reply URL**: select the **redirect URL**
157-
158-
c. Select **Run user flow**.
159-
160-
4. Go through sign-up flow and create an account
161-
162-
5. Onfido service will be called during the flow, after user attribute is created. If the flow is incomplete, check that user isn't saved in the directory.
155+
>[!NOTE]
156+
>If the flow is incomplete, confirm the user is saved in the directory.
163157
164158
## Next steps
165159

166-
For additional information, review the following articles:
167-
168160
- [Custom policies in Azure AD B2C](./custom-policy-overview.md)
169-
170161
- [Get started with custom policies in Azure AD B2C](tutorial-create-user-flows.md?pivots=b2c-custom-policy)

0 commit comments

Comments
 (0)