You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/partner-idemia.md
+51-72Lines changed: 51 additions & 72 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
-
title: Configure IDEMIA with Azure Active Directory B2C (Preview)
2
+
title: Configure IDEMIA Mobile ID with Azure Active Directory B2C
3
3
titleSuffix: Azure AD B2C
4
-
description: Learn how to integrate Azure AD B2C authentication with IDEMIA for relying party to consume IDEMIA or US State issued mobile IDs
4
+
description: Learn to integrate Azure AD B2C authentication with IDEMIA Mobile ID for a relying party to consume Mobile ID, or US state-issued mobile IDs
5
5
services: active-directory-b2c
6
6
author: gargi-sinha
7
7
manager: CelesteDG
@@ -15,118 +15,99 @@ ms.subservice: B2C
15
15
zone_pivot_groups: b2c-policy-type
16
16
---
17
17
18
-
# Tutorial: Configure IDEMIA with Azure Active Directory B2C for relying party to consume IDEMIA or US State issued mobile identity credentials (Preview)
# Tutorial: Configure IDEMIA Mobile ID with Azure Active Directory B2C
20
19
21
-
::: zone pivot="b2c-user-flow"
20
+
## Before you begin
22
21
23
-
This feature is available only for custom policies. For setup steps, select **Custom policy** in the preceding selector.
22
+
Azure Active Directory B2C (Azure AD B2C) has two methods to define users interaction with applications: predefined user flows or configurable custom policies.
24
23
25
-
::: zone-end
24
+
See, [User flows and custom policies overview](./user-flow-overview.md)
26
25
27
-
::: zone pivot="b2c-custom-policy"
28
-
29
-
In this sample tutorial, learn how to integrate Azure Active Directory (Azure AD) B2C with [IDEMIA](https://www.idemia.com/). IDEMIA is a passwordless authentication provider, which provides real-time consent-based services with biometric authentication like face ID and fingerprinting eliminating fraud and credential reuse. IDEMIA’s Mobile ID allows citizens to benefit from a government-issued trusted digital ID, as a complement to their physical ID. This application is used to verify identity by using a self-selected PIN or touch ID/face ID. Mobile ID allows citizens to control their identities by allowing them to share only the information needed for a transaction and enables fraud protection.
26
+
## Integrate Azure AD B2C with IDEMIA Mobile ID
30
27
28
+
IDEMIA provides biometric authentication services like face ID and fingerprinting, which reduces fraud and credential reuse. With Mobile ID, citizens benefit from a trusted, government-issued digital ID, as a complement to their physical ID. Mobile ID verifies identity by using a self-selected PIN, touch ID, or face ID. Citizens control their identities by sharing information needed for a transaction. Many state departments of motor vehicles (DMVs) use Mobile ID.
31
29
30
+
To learn more, go to idemia.com: [IDEMIA](https://www.idemia.com/)
32
31
33
32
## Scenario description
34
33
35
-
IDEMIA integration includes the following components:
36
-
37
-
-**Azure AD B2C** – The authorization server, responsible for verifying the user’s credentials, also known as the Identity Provider (IdP).
38
-
39
-
-**IDEMIA mID** - OpenID Connect (OIDC) provider configured as [Azure AD B2C external provider](add-identity-provider.md)
40
-
41
-
-**[IDEMIA mID application](https://idemia-mobile-id.com/)** - A trusted, government-issued digital identity. Mobile ID is a digital version of your driver’s license or state-issued ID that lives in an app on your phone. [IDEMIA](https://idemia-mobile-id.com/).
42
-
43
-
IDEMIA provides mID for many US State departments of motor vehicles (DMVs).
44
-
45
-
The mID is a digitizing of an identification document into a strong mobile identity token that is highly portable for verification and that serves as an index for authorization **mID Services**. The mID Service allows the DMVs to proof identities of individuals by using credential document authentication using their issued drivers licenses and biometric **selfie**-to-credential facial recognition matching services.
34
+
Mobile ID integration includes the following components:
46
35
47
-
Once created, the mID is stored on the end user's mobile phone as a digitally signed **identity on the edge**. The end users are now able to use that signed credential for access to other identity sensitive services such as proof of age, financial know your customer, account access’s where security is paramount.
36
+
***Azure AD B2C** – authorization server that verifies user credentials
37
+
* It's also known as the identity provider (IdP)
38
+
***IDEMIA Mobile ID** - OpenID Connect (OIDC) provider configured as an Azure AD B2C external provider
39
+
* See, [Add an identity provider to your Azure AD B2C tenant](add-identity-provider.md)
40
+
***[IDEMIA Mobile ID application]** - a digital version of a driver’s license, or state-issued ID, in an app on your phone
41
+
* See, [IDEMIA Mobile ID](https://idemia-mobile-id.com/)
48
42
49
-
The offer to Microsoft is the support of these services as the Relying party (RP) that will use a State issued mID to provide services using the attributes sent by the owner of the mID.
43
+
Mobile ID is a digitized identification document, a portable mobile identity token that DMVs use to verify individual identities. The signed digitized ID is stored on user mobile phones as an identity on the edge. The signed credentials ease access to identity services such as proof of age, financial know your customer, account access, etc.
50
44
51
-
The following diagram shows the implementation for web or on-premises scenarios:
45
+
The following diagram illustrates the sign-up and sign-in user flows with Mobile ID.
52
46
53
-
47
+
54
48
55
-
| Step | Description |
56
-
|:--------|:--------|
57
-
| 1. | User visits the Azure AD B2C login page, which is the replying party in this case on their device to conduct a transaction and logs in via their mID app. |
58
-
| 2. | Azure AD B2C requires an ID check and for that redirects the user to the IDEMIA router using the OIDC authorization code flow|
59
-
| 3. | The IDEMIA router sends a biometric challenge to the user’s mobile app including all context details of the authentication and authorization request.|
60
-
| 4. | Depending on the level of security needed, the user may require to provide additional details, input their PIN, take a live selfie, or both.|
61
-
| 5. | Final authentication response provides proof of possession, presence, and consent. The response is returned to the IDEMIA router.|
62
-
| 6. | IDEMIA router verifies the information provided by the user and replies to Azure AD B2C with the authentication result.|
63
-
|7. | Based on the authentication result user is granted/denied access. |
49
+
1. User visits the Azure AD B2C sign-in page (the replying party), with their device and Mobile ID, to conduct a transaction.
50
+
2. Azure AD B2C performs an ID check. It redirects the user to the IDEMIA router with an OIDC authorization code flow.
51
+
3. The router sends a biometric challenge to the user’s mobile app with authentication and authorization request details.
52
+
4. Depending on security, the user might be prompted provide additional details: input a PIN, take a live selfie, or both.
53
+
5. The authentication response provides proof of possession, presence, and consent. The response returns to the router.
54
+
6. The router verifies user information and replies to Azure AD B2C with the result.
55
+
7. The user is granted or denied access.
64
56
65
-
## Onboard with IDEMIA
57
+
## Enable Mobile ID
66
58
67
-
Get in touch with [IDEMIA](https://www.idemia.com/get-touch/) to request a demo. While filling out the request form, in the message field indicate that you want to onboard with Azure AD B2C.
59
+
To get started, go to the idemia.com [Get in touch](https://www.idemia.com/get-touch/)page to request a demo. In the request form text field, indicate your interest in Azure AD B2C integration.
68
60
69
-
## Integrate IDEMIA with Azure AD B2C
61
+
## Integrate Mobile ID with Azure AD B2C
70
62
71
63
## Prerequisites
72
64
73
-
To get started, you'll need:
65
+
To get started, you need:
74
66
75
-
- Access to end users that have an IDEMIA - US state issued Mobile ID credential (mID) or during the test phase, the mID demo application provided by [IDEMIA](https://www.idemia.com/).
67
+
* Access to users with an IDEMIA, US state issued Mobile ID credential (mID)
68
+
* Or during the test phase, the mID demo application from IDEMIA
69
+
* An Azure AD subscription
70
+
* If you don't have one, get an [Azure free account](https://azure.microsoft.com/free/)
71
+
* An [Azure AD B2C tenant](tutorial-create-tenant.md) linked to the Azure subscription
72
+
* Your business web application registered in Azure AD B2C tenant.
73
+
* For testing, configure https://jwt.ms, a Microsoft-owned web application with decoded token contents.
76
74
77
-
- An Azure AD subscription. If you don't have one, get a [free account](https://azure.microsoft.com/free/).
75
+
>[!NOTE]
76
+
>The token contents never leave your browser.
78
77
79
-
- An [Azure AD B2C tenant](tutorial-create-tenant.md) that is linked to your Azure subscription.
78
+
### Submit a relying party application for mID
80
79
81
-
- Your business web application registered in Azure AD B2C tenant. For testing purposes you can configure https://jwt.ms, a Microsoft-owned web application that displays the decoded contents of a token.
82
-
83
-
>[!NOTE]
84
-
>The contents of the token never leave your browser.
85
-
86
-
87
-
### Part 1 - Submit a Relying Party application on-boarding for mID
88
-
89
-
As part of your integration with IDEMIA, you'll be provided with the following information:
80
+
During Mobile ID integration, the following information is provided.
90
81
91
82
| Property | Description |
92
83
|:---------|:----------|
93
-
| Application Name | Azure AD B2C or your desired application name |
94
-
| Client_ID |This is the unique identifier provided by the IdP |
95
-
| Client Secret | Password the relying party application will use to authenticate with the IDEMIA IdP |
96
-
| Metadata endpoint | A URL that points to a token issuer configuration document, which is also known as an OpenID well-known configuration endpoint.|
97
-
|Redirect URIs |`https://your-B2C-tenant-name.b2clogin.com/your-B2C-tenant-name.onmicrosoft.com/oauth2/authresp`<br>For example, `https://fabrikam.b2clogin.com/fabrikam.onmicrosoft.com/oauth2/authresp`<br><br>If you use a custom domain, enter `https://your-domain-name/your-tenant-name.onmicrosoft.com/oauth2/authresp`.<br>Replace your-domain-name with your custom domain, and your-tenant-name with the name of your tenant. |
84
+
| Application Name | Azure AD B2C, or your an application name |
85
+
| Client_ID |The unique identifier from the identity provider (IdP)|
86
+
| Client Secret | Password the relying party application uses to authenticate with the IDEMIA IdP |
87
+
| Metadata endpoint | A URL pointing to a token issuer configuration document, also known as an OpenID well-known configuration endpoint |
88
+
|Redirect URIs |`https://your-B2C-tenant-name.b2clogin.com/your-B2C-tenant-name.onmicrosoft.com/oauth2/authresp`<br>For example, `https://fabrikam.b2clogin.com/fabrikam.onmicrosoft.com/oauth2/authresp`<br><br>If you use a custom domain, enter `https://your-domain-name/your-tenant-name.onmicrosoft.com/oauth2/authresp`.|
98
89
|Post log out redirect URIs |`https://your-B2C-tenant-name.b2clogin.com/your-B2C-tenant-name.onmicrosoft.com/{policy}/oauth2/v2.0/logout`<br>Send a sign-out request. |
99
90
100
91
>[!NOTE]
101
-
>You'll need IDEMIA client ID and client secret later to configure the IdP in Azure AD B2C.
92
+
>You need the Client ID and Client Secret later to configure the IdP in Azure AD B2C.
102
93
103
-
### Part 2 - Create a policy key
94
+
### Create a policy key
104
95
105
-
Store the IDEMIA client secret that you previously recorded in your Azure AD B2C tenant.
96
+
Store the noted IDEMIA Client Secret in your Azure AD B2C tenant. For the following instructions, use the directory with your Azure AD B2C tenant.
106
97
107
98
1. Sign in to the [Azure portal](https://portal.azure.com/).
108
-
109
-
2. Make sure you're using the directory that contains your Azure AD B2C tenant. Select the **Directories + subscriptions** icon in the portal toolbar.
110
-
99
+
2. In the portal toolbar, select the **Directories + subscriptions**.
111
100
3. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**.
112
-
113
101
4. Choose **All services** in the top-left corner of the Azure portal, and then search for and select **Azure AD B2C**.
114
-
115
102
5. On the **Overview** page, select **Identity Experience Framework**.
116
-
117
103
6. Select **Policy Keys** and then select **Add**.
118
-
119
104
7. For **Options**, choose **Manual**.
120
-
121
105
8. Enter a **Name** for the policy key. For example, IdemiaAppSecret. The prefix B2C_1A_ is added automatically to the name of your key.
122
-
123
106
9. In **Secret**, enter your client secret that you previously recorded.
124
-
125
107
10. For **Key** usage, select **Signature**.
126
-
127
108
11. Select **Create**.
128
109
129
-
### Part 3 - Configure IDEMIA as an External IdP
110
+
### Configure IDEMIA as an External IdP
130
111
131
112
To enable users to sign in using IDEMIA mobile ID passwordless identity, you need to define IDEMIA as a claims provider that Azure AD B2C can communicate with through an endpoint. The endpoint provides a set of claims that are used by Azure AD B2C to verify a specific user has authenticated using biometry such as fingerprint or facial scan as available on their device, proving the user’s identity.
132
113
You can define IDEMIA as a claims provider by adding it to the **ClaimsProvider** element in the extension file of your policy.
@@ -298,5 +279,3 @@ For additional information, review the following articles:
298
279
-[Get started with custom policies in Azure AD B2C](tutorial-create-user-flows.md?pivots=b2c-custom-policy)
299
280
300
281
-[Learn more about IDEMIA mID](https://www.idemia.com/mobile-id)
0 commit comments