(2019-10-04) Azure AD B2C – Setup The Identity Experience Framework

This post is a cross-post of a series of posts about Azure AD B2C. This post has been published here with permission from Wim van den Heijkant, a member of the Fortigi team. All credits, kudos, whatever go to the original writers of this post.

Original location of this post/article: Setup the Identity Experience Framework

–

Figure 1: JSON Sample With Environment Specific Information

–

Azure AD Business to Consumer is a very flexible and powerful identity platform. It allows you to completely control the user experience for your customer and partner facing applications. See About Azure AD B2C for more info.

Over the last year and a half or so we have implemented Azure AD B2C for a number of customers. Over the next couple of days / weeks I will be posting a number of blogs with some of the tips and tricks we learned along the way. I will also be sharing some example scripts, policies and PowerShell modules we have developed.

This blog is part of series on setting up Azure AD B2C Automated deployments. It explains how to setup the Identity Experience Framework. Also see; Creating A New Azure AD B2C Tenant.

–

Azure AD B2C has a component called the "Identity Experience Framework". This is what makes Azure AD B2C such an incredibly powerful platform. It allows you to fully customize the user flows for sign-in, sign-up, etc..

Identity Experience framework Policies are defined in XML format. There are a lot of examples on GitHub. In any serious environment you are going to want to deploy these policies as part of your DevOps process and release the policies using some form of automation. I like Azure DevOps but you could use Confluence, or any other platform of your choice, or just do the upload from the command line.

Having an automated deployment process for your policies allows you to keep a single version of your policies in a repo (like for example GitHub) and have your environment specific configuration in a separate JSON.

The JSON we use contains the following environment specific variables;

{

      "DEV": {

               "B2C_TENANT": "FortigiB2CDemo.onmicrosoft.com",

               "B2C_TOKEN_SIGNINGKEYCONTAINER": "TokenSigningKeyContainer",

               "B2C_TOKEN_ENCRYPTIONKEYCONTAINER": "TokenEncryptionKeyContainer",

               "B2C_TENANTID": "9eee23e3-5c63-4777-8b56-c91cbf665cae",

               "B2C_IEF_APPLICATIONID": "232f8e66-38d9-418c-a6e0-f676d23582a5",

               "B2C_IEF_PROXY_APPLICATIONID": "24109baf-ab87-493e-9a7c-fffe87d77014",

      },

      "TST": {…..}

}

–

In this blog post we will explain how to setup the Identity Experience Framework and gather all the required information to fill your JSON with the required environment specific variables. In the next post I will then explain how you can use this JSON to automatically deploy Azure AD B2C policies.

–

Prerequisites

You need to have an Azure AD B2C tenant setup. See my previous post Creating A New Azure AD B2C Tenant on how to do that. If you have a Azure AD B2C tenant you will be able to get the first variable of the JSON filled in;

Figure 2: JSON With Environment Specific Information – Retrieving The Domain Name Of The AAD B2C Tenant

–

"B2C_TENANT": "FortigiB2CDemo.onmicrosoft.com",

–

Step 1; Setup the Identity Experience Framework (IEF)

Microsoft explains how to setup the IEF here. I have "borrowed" most of my instructions from there, however I have added a couple of screenshots and remarks where I feel that helps explain things.

–

Add signing and encryption keys

1. Sign in to the Azure portal
2. Use the Directory + subscription filter in the top menu to select the directory that contains your Azure AD B2C tenant.
3. In the left menu, select Azure AD B2C. Or, select All services and search for and select Azure AD B2C.
4. On the Overview page, select Identity Experience Framework.

Figure 3: The Identity Experience Framework

–

Create the signing key

1. Select Policy Keys and then select Add.
2. For Options, choose Generate.
3. In Name, enter TokenSigningKeyContainer. The prefix B2C_1A_ might be added automatically.
4. For Key type, select RSA.
5. For Key usage, select Signature.
6. Select Create.

Figure 4: JSON With Environment Specific Information – Creating The Signing Key (Container) For The AAD B2C Tenant

–

If you stick with the default name, then you have the value for you second JSON variable;

"B2C_TOKEN_SIGNINGKEYCONTAINER": "TokenSigningKeyContainer",

–

Create the encryption key

1. Select Policy Keys and then select Add.
2. For Options, choose Generate.
3. In Name, enter TokenEncryptionKeyContainer. The prefix B2C_1A_ might be added automatically.
4. For Key type, select RSA.
5. For Key usage, select Encryption.
6. Select Create.

Figure 5: JSON With Environment Specific Information – Creating The Encryption Key (Container) For The AAD B2C Tenant

–

If you stick with the default name, then you have the value for you third JSON variable;

"B2C_TOKEN_ENCRYPTIONKEYCONTAINER": "TokenEncryptionKeyContainer",

–

Switch to the regular Azure AD console

1. Select All services in the top-left corner of the Azure portal.
2. In the search box, enter Azure Active Directory.
3. Select Azure Active Directory in the search results.

Most people I have tried to explain this to, find the next part hard to understand. The Azure AD B2C instance that you have created is both an Azure AD B2C as well as a regular Azure AD… it’s sort of backwards compatible. This means you can access your directory both using the Azure AD B2C interface. Where you can configure the B2C related things.. As well as through the regular Azure AD interface. Not all features that are available in the Azure AD are exposed in the Azure AD B2C interface. We therefore need to switch between consoles every now and then.

Now that you are on the regular console first, quickly get the TenantID, you need that in the JSON as well, you will find it under properties;

Figure 6: JSON With Environment Specific Information – Retrieving The Tenant ID Of The AAD B2C Tenant

–

Add the directory ID to the JSON;

"B2C_TENANTID": "9eee23e3-5c63-4777-8b56-c91cbf665cae",

–

Register the Identity Experience Framework applications

To create the apps (or actually.. I like the term service principal better.. that makes way more sense to me..) we need to go to the regular Azure AD console.

Azure AD B2C requires you to register two applications that are used to sign up and sign in users: IdentityExperienceFramework (a web app), and ProxyIdentityExperienceFramework (a native app) with delegated permission from the IdentityExperienceFramework app. Local accounts only exist in your tenant. Your users sign up with a unique email address/password combination to access your tenant-registered applications.

Basically, without these two Apps, you will not be able to use the local account option in the IEF policies. These apps are required to allow the IEF framework to access the directory. The IEF framework is (behind the scenes) a separate service, which needs permissions. Like the Microsoft Pages explain;

1. Select All services in the top-left corner of the Azure portal.
2. In the search box, enter Azure Active Directory.
3. Select Azure Active Directory in the search results.
4. Under Manage in the left-hand menu, select App registrations (Legacy).
5. Select New application registration.
6. For Name, enter IdentityExperienceFramework.
7. For Application type, choose Web app/API.
8. For Sign-on URL, enter https://your-tenant-name.b2clogin.com/your-tenant-name.onmicrosoft.com, where your-tenant-name is your Azure AD B2C tenant domain name. All URLs should now be using b2clogin.com.
9. Select Create. After it’s created, copy the application ID and save it to use later.

Figure 7: JSON With Environment Specific Information – Registering The Identity Experience Framework Application

–

We used; https://fortigib2cdemo.b2clogin.com/fortigib2cdemo.onmicrosoft.com as the sign-on URL for the tenant we created earlier.

The application ID needs to be added to the JSON;

"B2C_IEF_APPLICATIONID": "56946d8a-8920-462b-91a3-58f715caea58",

–

Register the ProxyIdentityExperienceFramework application

1. In App registrations (Legacy), select New application registration.
2. For Name, enter ProxyIdentityExperienceFramework.
3. For Application type, choose Native.
4. For Redirect URI, enter https://your-tenant-name.b2clogin.com/your-tenant-name.onmicrosoft.com, where your-tenant-name is your Azure AD B2C tenant.
5. Select Create. After it’s created, copy the application ID and save it to use later.

Figure 8: JSON With Environment Specific Information – Registering The Proxy Identity Experience Framework Application

–

The application ID needs to be added to the JSON;

"B2C_IEF_PROXY_APPLICATIONID": "b41323fa-da14-430a-bcd5-f6580f81b1b5"

–

1. Select Settings, then select Required permissions, and then select Add.
2. Choose Select an API, search for and select IdentityExperienceFramework, and then click Select.
3. Select the check box next to Access IdentityExperienceFramework, click Select, and then click Done.
4. Select Grant permissions, and then confirm by selecting Yes.

Figure 9: Configuring Permissions For The Proxy Identity Experience Framework Application

–

Thanks to Taeke Kooiker for reviewing this article.

–

Cheers,

Jorge

————————————————————————————————————————————————————-
This posting is provided "AS IS" with no warranties and confers no rights!
Always evaluate/test everything yourself first before using/implementing this in production!
This is today’s opinion/technology, it might be different tomorrow and will definitely be different in 10 years!
DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/
————————————————————————————————————————————————————-
########################### Jorge’s Quest For Knowledge ##########################
#################### http://JorgeQuestForKnowledge.wordpress.com/ ###################
————————————————————————————————————————————————————-

(2019-10-02) Azure AD B2C – Creating A New Azure AD B2C Tenant

This post is a cross-post of a series of posts about Azure AD B2C. This post has been published here with permission from Wim van den Heijkant, a member of the Fortigi team. All credits, kudos, whatever go to the original writers of this post.

Original location of this post/article: Creating a new Azure AD B2C tenant

–

Figure 1: Azure AD B2C Highlights

–

Azure AD Business to Consumer is a very flexible and powerful identity platform. It allows you to completely control the user experience for your customer and partner facing applications. See About Azure AD B2C for more info.

Over the last year and a half or so we have implemented Azure AD B2C for a number of customers. Over the next couple of days / weeks I will be posting a number of blogs with some of the tips and tricks we learned along the way. I will also be sharing some example scripts, policies and Powershell modules we have developed.

In this first post we explain the process of creating a new Azure AD B2C tenant within your existing Azure environment, adding other admins etc.

Start by logging in to your Azure Subscription and create a new Resource Group:

Figure 2: Creating A Resource Group For The AAD B2C Tenant

–

Add a new Azure AD B2C tenant, by clicking add new resource and searching for B2C;

Figure 3: Looking For The AAD B2C Resource In The Marketplace

–

After clicking create you will get 2 options;

Figure 4: Choosing Between New Or Linking Existing AAD B2C Tenant

–

The first step is to create a new Azure AD B2C tenant, after that you can link the tenant to your Azure Subscription so it becomes visible in your resource group. The first step is to create, then we will link. Click Create new Azure AD B2C Tenant;

Figure 5: Providing The Basic Details For The AAD B2C

–

This will take a minute. When it’s done you will get;

Figure 6: Confirmation After The AAD B2C Tenant Has Been Created

–

You can click here in the message, but we still need to link it to our subscription, so let’s do that first. Close the Create new tenant screen, and go back to the Create or link screen. When we click link an existing Azure AD B2C Tenant to my Azure subscription, we get;

Figure 7: Linking An Existing AAD B2C Tenant To A Subscription

–

It now shows up in the drop down list. After clicking create it will show up in your resource group;

Figure 8: The AAD B2C Tenant Listed Within The Assigned Subscription

–

Open the resource and you will see;

Figure 9: An Overview Of The AAD B2C Tenant

–

Click Azure AD B2C settings and you will be redirected to the Azure AD B2C setting page;

Figure 10: The AAD B2C Settings Page

–

Notice that you are actually directed to a completely new Azure Tenant. This is due to the fact that Azure AD B2C is also a directory, which now only contains a single user. The user you used to create the tenant;

Figure 11: The Default AAD B2C Tenant Admin, The Account That Created The AAD B2C Tenant

–

Also when we look for "our other Azure resources" there is nothing there;

Figure 12: Additional Resources Page For The AAD B2C Tenant

–

To switch back to your default Azure Tenant, use the directory selector in the top;

Figure 13: Selecting Another Directory

–

I have access to a rather large number of B2C tenants so I will see a lot of them. But you will most probably only see 2. The new B2C tenant and your original Azure tenant;

Figure 14: The List Of Available AAD Directories The Account Has Access To

–

You have now created an Azure AD B2C tenant that you can start to use. You can create new Azure AD B2C users or invite your colleagues (which live in the "normal" Azure AD) by going to users, and selecting "new guest user". They will receive an invite link. All this works very similar to how the normal Azure AD works. Adding at least one other colleague would be my recommendation.This will prevent you from not being able to access the directory when your credentials are accidentally lost.

Figure 15: Creating A New Account Within The AAD B2C Tenant

–

Also note, that if you are adding a colleague that doesn’t have an e-mail address to match his account name, for example if you are inviting a non-personal or service account the invitation e-mail will not reach the user. To work around this issue, open the user you just invited and click the resend invitation button; once you click it.. it will allow you to copy the invitation URL… open this URL while logged in as the account you want to give access.. And your invitation will be redeemed. Basically creating a "foreign security principal" in the B2C directory.

Figure 16: The Settings Page Of A User Account Within The AAD B2C Tenant

–

Special thanks to my colleague Taeke Kooiker for his reviews and help with this article

–

Cheers,

Jorge

————————————————————————————————————————————————————-
This posting is provided "AS IS" with no warranties and confers no rights!
Always evaluate/test everything yourself first before using/implementing this in production!
This is today’s opinion/technology, it might be different tomorrow and will definitely be different in 10 years!
DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/
————————————————————————————————————————————————————-
########################### Jorge’s Quest For Knowledge ##########################
#################### http://JorgeQuestForKnowledge.wordpress.com/ ###################
————————————————————————————————————————————————————-