Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Azure AD B2C An Introduction - DogFoodCon 2018
Similar to Azure AD B2C An Introduction - DogFoodCon 2018 (20)
Recently uploaded
Recently uploaded (20)
Azure AD B2C An Introduction - DogFoodCon 2018
- 1. Azure AD B2C DogFoodCon Jeremy Gray Microsoft Cloud Solution Architect, Financial Services 10/4/2018
- 4. © Microsoft Corporation Contents ## What Problem are we Solving ## Some Definitions ## Typical Customer Interactions ## OpenId Connect Overview ## Tokens ## A Basic Application ## Adding users with the GraphApi
- 5. How can businesses securely connect with their customers?
- 6. © Microsoft Corporation Authentication: The process of confirming identity Authorization: Specifying access rights to resources OAuth 2.0: OAuth 2.0 is the industry-standard protocol for authorization. OAuth 2.0 focuses on client developer simplicity while providing specific authorization flows for web applications, desktop applications, mobile phones, and living room devices. This specification and its extensions are being developed within the IETF OAuth Working Group. OpenId Connect: OpenID Connect (OIDC) is an authentication layer on top of OAuth 2.0, an authorization framework. The standard is controlled by the OpenID Foundation. Client: This is an application, not a user Definitions
- 7. © Microsoft Corporation Types of Users Employees Customers Administrators
- 8. © Microsoft Corporation • Interoperability • The client-server authentication model doesn’t account for mobile (non-browser) devices, or anything cross- domain. • Netscape came up with cookies before api’s and interop were issues. • The ability to restrict access to a limited subset of resources for a specified duration is difficult. • Governance • Credentials must be shared with 3rd parties • 3rd party systems we store credentials in can’t be governed • Revoking access to the 3rd party would mean changing all stored (user) passwords. Some classic problems
- 9. © Microsoft Corporation A “new” scenario
- 10. © Microsoft Corporation auth_token sample This is encoded (not encrypted) and signed by the issuer certificate
- 11. © Microsoft Corporation id_token sample This is encoded (not encrypted) and signed by the issuer certificate
- 12. Apps Analytics Line of business integration Business Social IDs Business & Government IDs contoso Customers Azure Active Directory B2C Securely authenticate your customers using their preferred identity provider Capture login, preference, and conversion data for customers Provide branded (white-label) registration and login experiences FARM BUREAU
- 13. © Microsoft Corporation Demo - Basic
- 14. © Microsoft Corporation Here is what that looks like
- 15. © Microsoft Corporation Using Graph Api / User Migration
- 16. © Microsoft Corporation Pre-migration flow If you have access to a user’s credentials. User database Web App AD B2C old login Migration App 1. Read Users 2. Create users with Graph Api 3. Cutover login screen new login
- 17. © Microsoft Corporation Pre-migration flow + Password Reset You have no access to a user’s credentials. User database Web App AD B2C old login Migration App 1. Read Users 2. Create users with Graph Api
- 18. © Microsoft Corporation Demo Using Graph Api / User Migration
- 19. User journeys Open standards Connect to a store or migrate its users Conditional branching Enrich user journeys Connect with existing systems Build complex apps with open standards Identity Experts Tailor every step of your user journey to have complete control Integrate with any SAML or OIDC identity provider Use REST APIs to enrich claims and empower user journeys Customize your user journeys with conditional branching Connect with existing CRM systems, marketing tools, and databases Connect to your existing user stores or migrate from those systems seamlessly
- 20. © Copyright Microsoft Corporation. All rights reserved.
Editor's Notes
- There has never been a better time to be in technology.
- Rock my linked in https://www.linkedin.com/in/thejeremygray/
- This is how I think of users, employees (inclucing consultants/contractors or anyone we have a company level contract with) are like dogs…loyal they do what you want most of the time, we trust them. Customers are like cats, they like us most of the time, but wouldn’t really notice if we didn’t exists anymore. Internal administrators have a higher level of access and should be governed at a higher level.
- These issues lead to us creating islands of authentication with no interop between them.
- Log into Walmart and pull resources from flickr to print…how do we do this?
- Jwt.io
- Notice the “aud” / audience, this is scoped to the web application whereas the auth token is scoped to the function.
- https://github.com/Azure-Samples/active-directory-b2c-dotnet-webapp-and-webapi
- Heres a lovely drawing written on really old letterhead.
- https://github.com/Azure-Samples/active-directory-b2c-dotnet-webapp-and-webapi https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-devquickstarts-graph-dotnet
- https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-user-migration
- https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-user-migration You have options here on how to do the cutover and you should make a smart decision based on your users. The easiest would be to do a blanket password reset cutover. Send an email and say “Your password has been reset”, making them go through the normal password reset policy. A little less intrusive would be to manage in your application which IdP the user is on and cut them over when their current password expires.
- https://github.com/Azure-Samples/active-directory-b2c-dotnet-webapp-and-webapi https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-devquickstarts-graph-dotnet cd C:\src\B2C-GraphAPI-DotNet\B2CGraphClient\bin\Debug B2C Create-User ..\..\..\usertemplate-email.json B2C Create-User ..\..\..\usertemplate-username.json
- Integrate with developer tools, libraries, and SDKs supporting OAUTH/Open ID Connect