Skip to content

Commit b5fe780

Browse files
JasSuriJasSuri
authored
Merge pull request #671 from rbrayb/master
Create a full implementation of the REST API based on sample "migrate-to-entra-external-id-for-customers"
2 parents 6450644 + 6b6e92a commit b5fe780

File tree

14 files changed

+2739
-0
lines changed

14 files changed

+2739
-0
lines changed

‎policies/migrate-to-entra-external-id-for-customers-full/media/Permissions.png‎

149 KB
Loading

‎policies/migrate-to-entra-external-id-for-customers-full/media/high-level-design.png‎

65.3 KB
Loading

‎policies/migrate-to-entra-external-id-for-customers-full/media/signin.png‎

69.3 KB
Loading

‎policies/migrate-to-entra-external-id-for-customers-full/media/signup.png‎

71 KB
Loading

‎policies/migrate-to-entra-external-id-for-customers-full/policy/B2C_1A_Extension_OrchestrateToCiam_Full.xml‎

Lines changed: 1529 additions & 0 deletions
Large diffs are not rendered by default.

‎policies/migrate-to-entra-external-id-for-customers-full/policy/B2C_1A_OrchestrateToCiam_PasswordReset.xml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2+
<TrustFrameworkPolicy
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
5+
xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06"
6+
PolicySchemaVersion="0.3.0.0"
7+
TenantId="tenant.onmicrosoft.com"
8+
PolicyId="B2C_1A_OrchestrateToCiam_Full_PasswordReset"
9+
PublicPolicyUri="http://tenant.onmicrosoft.com/B2C_1A_OrchestrateToCiam_Full_PasswordReset"
10+
DeploymentMode="Development" UserJourneyRecorderEndpoint="urn:journeyrecorder:applicationinsights"
11+
>
12+
13+
<BasePolicy>
14+
<TenantId>tenant.onmicrosoft.com</TenantId>
15+
<PolicyId>B2C_1A_Extension_OrchestrateToCiam_Full</PolicyId>
16+
</BasePolicy>
17+
18+
<RelyingParty>
19+
<DefaultUserJourney ReferenceId="CIAM-PasswordReset" />
20+
<!-- Uncomment the following lines to enable Journey Insights and add the instrumentation key -->
21+
<!-- <UserJourneyBehaviors>
22+
<JourneyInsights TelemetryEngine="ApplicationInsights" InstrumentationKey="" DeveloperMode="true" ClientEnabled="false" ServerEnabled="true" TelemetryVersion="1.0.0" />
23+
</UserJourneyBehaviors> -->
24+
<TechnicalProfile Id="PolicyProfile">
25+
<DisplayName>PolicyProfile</DisplayName>
26+
<Protocol Name="OpenIdConnect" />
27+
<OutputClaims>
28+
<OutputClaim ClaimTypeReferenceId="email" />
29+
<OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/>
30+
<OutputClaim ClaimTypeReferenceId="tenantId" AlwaysUseDefaultValue="true" DefaultValue="{Policy:TenantObjectId}" />
31+
</OutputClaims>
32+
<SubjectNamingInfo ClaimType="sub" />
33+
</TechnicalProfile>
34+
</RelyingParty>
35+
</TrustFrameworkPolicy>

‎policies/migrate-to-entra-external-id-for-customers-full/policy/B2C_1A_OrchestrateToCiam_ProfileEdit.xml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2+
<TrustFrameworkPolicy
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
5+
xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06"
6+
PolicySchemaVersion="0.3.0.0"
7+
TenantId="tenant.onmicrosoft.com"
8+
PolicyId="B2C_1A_OrchestrateToCiam_Full_ProfileEdit"
9+
PublicPolicyUri="http://tenant.onmicrosoft.com/B2C_1A_OrchestrateToCiam_Full_ProfileEdit"
10+
DeploymentMode="Development" UserJourneyRecorderEndpoint="urn:journeyrecorder:applicationinsights">
11+
12+
<BasePolicy>
13+
<TenantId>tenant.onmicrosoft.com</TenantId>
14+
<PolicyId>B2C_1A_Extension_OrchestrateToCiam_Full</PolicyId>
15+
</BasePolicy>
16+
17+
<RelyingParty>
18+
<DefaultUserJourney ReferenceId="CIAM-ProfileEdit" />
19+
<!-- Uncomment the following lines to enable Journey Insights and add the instrumentation key -->
20+
<!-- <UserJourneyBehaviors>
21+
<JourneyInsights TelemetryEngine="ApplicationInsights" InstrumentationKey="" DeveloperMode="true" ClientEnabled="false" ServerEnabled="true" TelemetryVersion="1.0.0" />
22+
</UserJourneyBehaviors> -->
23+
<TechnicalProfile Id="PolicyProfile">
24+
<DisplayName>PolicyProfile</DisplayName>
25+
<Protocol Name="OpenIdConnect" />
26+
<OutputClaims>
27+
<OutputClaim ClaimTypeReferenceId="email"/>
28+
<OutputClaim ClaimTypeReferenceId="signInName"/>
29+
<OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/>
30+
<OutputClaim ClaimTypeReferenceId="tenantId" AlwaysUseDefaultValue="true" DefaultValue="{Policy:TenantObjectId}" />
31+
</OutputClaims>
32+
<SubjectNamingInfo ClaimType="sub" />
33+
</TechnicalProfile>
34+
</RelyingParty>
35+
</TrustFrameworkPolicy>

‎policies/migrate-to-entra-external-id-for-customers-full/policy/B2C_1A_OrchestrateToCiam_SignUpOrSignin.xml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2+
<TrustFrameworkPolicy
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
5+
xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06"
6+
PolicySchemaVersion="0.3.0.0"
7+
TenantId="tenant.onmicrosoft.com"
8+
PolicyId="B2C_1A_OrchestrateToCiam_Full_SignUpOrSignin"
9+
PublicPolicyUri="http://tenant.onmicrosoft.com/B2C_1A_OrchestrateToCiam_Full_SignUpOrSignin"
10+
DeploymentMode="Development" UserJourneyRecorderEndpoint="urn:journeyrecorder:applicationinsights">
11+
12+
<BasePolicy>
13+
<TenantId>tenant.onmicrosoft.com</TenantId>
14+
<PolicyId>B2C_1A_Extension_OrchestrateToCiam_Full</PolicyId>
15+
</BasePolicy>
16+
17+
<RelyingParty>
18+
<DefaultUserJourney ReferenceId="CIAM-SignUpOrSignIn" />
19+
<!-- Uncomment the following lines to enable Journey Insights and add the instrumentation key -->
20+
<!-- <UserJourneyBehaviors>
21+
<JourneyInsights TelemetryEngine="ApplicationInsights"
22+
InstrumentationKey="" DeveloperMode="true"
23+
ClientEnabled="false" ServerEnabled="true" TelemetryVersion="1.0.0" />
24+
</UserJourneyBehaviors> -->
25+
<TechnicalProfile Id="PolicyProfile">
26+
<DisplayName>PolicyProfile</DisplayName>
27+
<Protocol Name="OpenIdConnect" />
28+
<OutputClaims>
29+
<OutputClaim ClaimTypeReferenceId="displayName" />
30+
<OutputClaim ClaimTypeReferenceId="givenName" />
31+
<OutputClaim ClaimTypeReferenceId="surname" />
32+
<OutputClaim ClaimTypeReferenceId="email" />
33+
<OutputClaim ClaimTypeReferenceId="phoneNumberString" />
34+
<OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub" />
35+
<OutputClaim ClaimTypeReferenceId="tenantId" AlwaysUseDefaultValue="true"
36+
DefaultValue="{Policy:TenantObjectId}" />
37+
<OutputClaim ClaimTypeReferenceId="groups" DefaultValue="null" />
38+
<OutputClaim ClaimTypeReferenceId="roles" DefaultValue="null" />
39+
</OutputClaims>
40+
<SubjectNamingInfo ClaimType="sub" />
41+
</TechnicalProfile>
42+
</RelyingParty>
43+
</TrustFrameworkPolicy>

‎policies/migrate-to-entra-external-id-for-customers-full/readme.md‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
# Azure AD B2C Interface for Entra External ID migration
2+
3+
Please log any issues or questions in the repo.
4+
5+
## Summary
6+
7+
This sample will use AAD B2C as the journey orchestrator, whilst creating and authenticating users in the Entra External Id tenant. This makes it easier in the future to move apps to Entra External Id without disruption to your users. This sample performs sign up/in with MFA using Azure AD B2C, whilst maintaining user profiles in the Entra External Id tenant.
8+
9+
This allows you to use B2C custom policies with the user data residing on an Entra External ID tenant
10+
11+
This repo. was cloned from this [sample](https://github.com/azure-ad-b2c/samples/tree/master/policies/migrate-to-entra-external-id-for-customers)
12+
13+
The original sample implemented a subset of the API calls. This repo. implements them all.
14+
15+
This repo. also implements authentication using native auth. rather than ROPC.
16+
17+
The code also includes RP for "Profile Edit" and "Password Reset".
18+
19+
## REST API
20+
21+
There are REST API for:
22+
23+
* "REST-CIAM-UserReadUsingObjectIdOrEmail"
24+
* "REST-CIAM-UserReadUsingAlternativeSecurityId"
25+
* "REST-CIAM-UserWriteUsingLogonEmail"
26+
* "REST-CIAM-UserWriteUsingAlternativeSecurityId"
27+
* "REST-login-NonInteractive-CIAM"
28+
* "REST-fetchUserProfile-CIAM"
29+
* "REST-CIAM-UserUpdateUsingLogonEmail"
30+
31+
The source for the REST AI is an an Azure function but the repo. uses ngrok so those calls
32+
need to be replaced with the actual function URL.
33+
34+
Use "ngrok http 7257" if you want to use ngrok. (This allows you to run on localhost rather then using an Azure function).
35+
36+
## Functionality
37+
38+
The code handles:
39+
40+
* Local account signup via link on the login page
41+
* Local account sign-in via login page using native authentication, not ROPC
42+
* Social account logins via federation buttons on the login page
43+
* MFA via SMS
44+
* Password reset via embedded link on the login page
45+
* Password reset via RP
46+
* Profile edit via RP
47+
48+
## Setup ##
49+
50+
The “GraphCallsFromB2CTenant” application registration needs the following permissions:
51+
52+
![Permissions](media/Permissions.png)
53+
54+
## Original set up instructions - How it works
55+
56+
Users are sent to the AAD B2C authentication endpoint. An Azure function orchestrates all Read/Write operations to the Entra External Id directory.
57+
58+
![High level design](media/high-level-design.png)
59+
60+
![Sign up with MFA](media/signup.png)
61+
62+
![Sign in with MFA](media/signin.png)
63+
64+
## How to set it up
65+
66+
### Create application registrations
67+
1. Create an Application registration in the Entra External Id tenant, named **RopcFromB2C**. Choose Native App. Copy the AppId/ClientId
68+
1. In the Authentication menu, enable **Allow public client**
69+
1. In the manifest, set
70+
71+
1. Create an Application registration in the Entra External Id tenant, named **GraphCallsFromB2CTenant**. Choose Web App. Copy the AppId/ClientId
72+
1. Under API permissions, add MS Graph API **Application** permissions: `User.ReadWrite.All` and `UserAuthenticationMethod.ReadWrite.All`
73+
1. Under **Certificates & secrets**, generate a new secret. Copy this secret to be placed in the Azure function code
74+
75+
### Modifications in Azure Function
76+
1. Change all instances of `your-tenant-id-guid` to your tenant guid or name eg `contoso.onmicrosoft.com`
77+
1. Change all instances of `your-clientId-RopcFromB2C` to the AppId of the **RopcFromB2C** App registration
78+
1. Change all instances of `your-client-id-to-call-graph` to the AppId of the **GraphCallsFromB2CTenant** App registration
79+
1. Change all instances of `your-client-secret` to the secret generated on the **GraphCallsFromB2CTenant** App registration
80+
81+
### Host the Azure function
82+
1. In any production scenario, enable authentication in the Azure function. Eg, OAuth.
83+
84+
### Quick Deploy
85+
You can quick deploy the sample into your tenant, and then make the changes in the next section.
86+
Use this [link to quick deploy](https://b2ciefsetupapp.azurewebsites.net/Home/Experimental?sampleFolderName=migrate-to-entra-external-id-for-customers) into your tenant.
87+
88+
89+
#### Required modifications in policy file
90+
1. Change all instances of `your-tenant` to your tenant name, eg: `contoso.onmicrosoft.com`
91+
1. Change all instances of `your-api-endpoint` to your Azure function endpoint.
92+
1. In any production scenario, enable authentication in the REST API technical profiles.
93+
94+
## Testing
95+
Scenarios to test:
96+
1. Sign up via this AAD B2C custom policy with an account that does not already exist
97+
1. Sign in via this AAD B2C custom policy with an account that does exist
98+
1. Sign up via this AAD B2C custom policy with an account that does already exist
99+
1. Sign in via this AAD B2C custom policy with an account that does not exist
100+
1. Assign the user to a group/role in Entra External Id tenant, then perform a sign in
101+
1. Create a User Flow in Entra External Id tenant, and perform a Sign In via Entra External Id tenant with an account that was created via this AAD B2C custom policy
102+
1. Sign in via this AAD B2C custom policy with an account that was created using the User Flow from Entra External Id tenant
103+
1. View the User Profile after Sign Up in the Entra External Id tenant. Ensure the `Authentication Methods` menu is correctly populated with the users phone number visible, after sign up via this AAD B2C custom policy

0 commit comments

Comments
 (0)