Azure AD B2C with external authorization store

This video presents how to implement external authorization store with Azure AD B2C identity service.
Helpful links:
Azure AD B2C with external authorization store article:
daniel-krzyczkowski.github.io...
Get started with custom policies:
docs.microsoft.com/en-us/azur...
Identity Developer Templates project on GitHub:
github.com/Daniel-Krzyczkowsk...

[@abdullahsalemws]

Very helpful video, thanks Daniel!

[@argeelearner3978]

great video! thanks for sharing!

[@TechMindFactory]

Thank you!

[@pavankumars9313]

Hi thanks for this great video 😀

[@Vptkvc]

Great video, but I wish that you went more in depth with the whole flow, including azure functions. I think, there's another approach to this challenge regardless of the Identity Provider, how and where you pull users permissions from and without using any cloud service such as azure functions to depend on to do that for you. Basically you would define new authorization requirement with handler (ie: HasPermissionsRequirement and HasPermissionsHandler) then you would create AuthorizationPolicyProvider class (similar to the example in video) that would parse through claims and create policies out of it based on any condition and then, you would add PermissionsToClaims middleware in which you would inject database provider or http client to call any internal/external database or API endpoint and pull permissions for given user (transform the way you want, if needed) and add them to claims. You would end up with total of 4 new classes to do it all for your in one project.

[@TechMindFactory]

Yes, there is another approach you proposed and it is also correct. In my solution you call external authorization store only once during user authentication and injects authorization data in the access token returned by the Azure AD B2C. Then application can handle authorization using claims in this token. In the approach you have proposed you have to do round trips to the authorization database and API each time you call one of the endpoints on your API/Application. There has to be architectural decision made basing on your specific solution you build and use case.

[@titobundy]

I recently read the article “API connectors to customize and extend sign-up user flows with external identity data sources”, I think it is another solution to the issue of adding the roles to the token through an external service

[@TechMindFactory]

Yes, this is truth. API Connectors are used for User Flows in the Azure AD B2C so you can call external service during user authentication. My approach is more extensive and refers to custom policies (at the time of recording there were no API connectors).

[@DG-cd3jb]

Hi there, It’s a very helpful info provided on the Microsoft Azure identity service ADB2C. Can you also suggest the best way to learn, design and implement the identity and access managing solutions using ADB2C through custom policies & built-In flows to handling the end users accessing a SPA app? Dealing with a requirement to manage a local and social / federated users… If possible, please create a lecture on handling the custom user flows via ADB2C custom policies and built-in flows would helps a lot. Thanks!

[@TechMindFactory]

Hi, Thank you for kind words, I am happy that you found my video interesting. When it comes to deep dive into Azure AD B2C and building modern identity platform - please stay tuned, I have new series in progress and soon I will share more updates.

[@khalednabilcs]

Hi Daniel, Thanks for the great videos!! You mentioned right now there is no authorization mechanism in AZ B2C and I understand it is almost a year now, Is there any update on this statement ? Plus if I want to connect my custom policy to an API is it possible ? Regards,

[@TechMindFactory]

Hi! Thank you for a kind words! am happy that you found my videos helpful. When it comes to authorization mechanism - this is correct, there is no update yet. If you want to build authorization system, you have to handle it using external API and token enrichment. In this case you can call external authorization API and get user roles or groups and include them in the token. You can call API from the custom policies and user flows: You can check this documentation: docs.microsoft.com/en-us/azure/active-directory-b2c/api-connectors-overview?pivots=b2c-custom-policy

[@naveenbest]

Hi, web application URL is given B2C for Login, If Webapplication is down how the login works? I mean for Disaster Recovery how does B2C works?

[@iotality]

Hi, this is a great solution for the limitations in AD B2C as it doesn't have in-built authorization mechanism for user based authorization. However, I think you will also need to have a custom policy for sign-up so that a new user can be assigned to the respective group in the Azure SQL database. Perhaps the user gets assigned to a least privileged group and then some application admin can assign the user to appropriate group. Is that right? Thank you for the video and article on your blog, very helpful!

[@TechMindFactory]

Thank you for a kind words and for watching! It is exactly as you described it. This video presents some concepts and parts of the implementation. Of course users have to be assigned to specific roles and this process has to be controlled somehow (by admin app for instance).

[@iotality]

@@TechMindFactory thank you for getting back. It does help.

[@sahilroyal8939]

When will B2C support On-Behalf - of (OBO) Grant to support API chaining scenarios with this external authorization system?

[@TechMindFactory]

Good question but unfortunately I do not have such information. I only know that this scenario is reported to the AD B2C Team as important feature to be added in the future.

[@crankit119]

Hi Daniel. Do you the Azure SQL Database tables scripts somewhere? I can't find it.

[@TechMindFactory]

Unfortunately I do not have them but let me check if I can re-create them and share.

[@TechMindFactory]

Here are the scripts to create tables: gist.github.com/Daniel-Krzyczkowski/34649cbd43e263d31b14ec1440763488

[@cokec3667]

In azure B2C there is no useirnfo endpoint which I'd required while configuring sslesforce using OIDC auth provider. Is there any easy way to achieve this

[@TechMindFactory]

In this case you have to follow steps from this documentation: docs.microsoft.com/en-us/azure/active-directory-b2c/userinfo-endpoint?pivots=b2c-custom-policy This feature is available for custom policies only for now.

[@pavankumars9313]

I can see you have used function code authorisation directly in custom policy in xml it could breach security some Time how to secure it ? Is there any option to hide it ?

[@Duelweb]

This article is out of date ! I just wish content providers would stay relevant by keeping their videos current !!

[@JayTheKing111]

Is there a special requirement to be able to use custom policies? In my b2c tenant the option is greyed out for me.

[@TechMindFactory]

Yes, you have to setup Identity Experience Framework first. Here are the detailed steps to do it: docs.microsoft.com/en-us/azure/active-directory-b2c/custom-policy-get-started

[@cokec3667]

How do sync data from salesforce using mulesoft with Azure B2C? Is any other way to get data sync from salesforce DB. Would be great if get response

[@TechMindFactory]

To integrate Salesforce using MuleSoft and sync user data you have to use Microsoft Graph to communicate with the Azure AD B2C. Please see this link: docs.microsoft.com/en-us/azure/active-directory-b2c/manage-user-accounts-graph-api Now once there is an update in Salesforce, you can call Microsoft Graph API using MuleSoft to push specific user data to the Azure AD B2C. Please let me know if you have any other questions.

[@pavankumars9313]

Hi Daniel it's very helpful can you please share the source code ? I checked the one present in git hub but could not find it

[@cokec3667]

Thank You. We are working on B2C project 1. Using built in user flow can we do welcome mail and first time force password reset 2. What is default expiration time if accounts is idle 3. Can we do bulk one time upload users?? 4. Any way we may go with mobile otp instead of mail using in user flow Would be great if get response

[@TechMindFactory]

Here are the answers to your questions: 1. To be able to send welcome email you will have to switch to custom policies - with user flows this scenario is not possible. With custom policies you could call external API during new user registration and then send welcome email from this API. 2. There is no password expiration policy for local accounts by default. 3. Yes - but in this case you will have to use Microsoft Graph and create custom application to pull user account data and call Microsoft Graph API in the loop to create accounts in the Azure AD B2C. 4. No - with user flows it is not possible currently. Again, in this case you have to use custom policies. I hope these answers help you.

[@wpgdewit]

Hi, I used to think this could be solved by using security groups in the B2C tenant and Microsoft Graph API to add or remove users from these groups. Then in turn, my app could receive the security group a person belongs to and grant permissions based on that. From your video I learn that this is not a valid approach correct?

[@TechMindFactory]

Hi Wouter, Your apprach is valid too. In my solution I just showed how to implement custom authorization store. In your apprach you use security groups but still to inject them you need this external call to Microsoft Graph API. Both solutions are correct, everything depends on the needs and scenario.

[@saurabhazure3693]

Can we expose AZURE AD API to B2C users without using client credential flow .. I mean API/Webapp is registered in Azure AD(B2B) and access should be given to B2C users

[@TechMindFactory]

Good question! No, currently (at the moment of writing this answer) only client credentials flow is available. There is no way to use Microsoft Graph API with the token returned from the Azure AD B2C in context of concrete user.