Set up sign-up and sign-in with generic OpenID Connect using Azure Active Directory B2C

• Create a user flow so users can sign up and sign in to your application.
• Register a web application.

• Complete the steps in Get started with custom policies in Active Directory B2C. This tutorial guides you how to update custom policy files to use your Azure AD B2C tenant configuration.
• Register a web application.

1. Sign in to the Azure portal as the global administrator of your Azure AD B2C tenant.
2. If you have access to multiple tenants, select the Settings icon in the top menu to switch to your Azure AD B2C tenant from the Directories + subscriptions menu.
3. Choose All services in the top-left corner of the Azure portal, search for and select Azure AD B2C.
4. Select Identity providers, and then select New OpenID Connect provider.
5. Enter a Name. For example, enter Contoso.

Define the OpenId Connect identity provider by adding it to the ClaimsProviders element in the extension file of your policy.

1. Open the TrustFrameworkExtensions.xml.

2. Find the ClaimsProviders element. If it does not exist, add it under the root element.

3. Add a new ClaimsProvider as follows:

   <ClaimsProvider>
     <Domain>contoso.com</Domain>
     <DisplayName>Login with Contoso</DisplayName>
     <TechnicalProfiles>
       <TechnicalProfile Id="Contoso-OpenIdConnect">
         <DisplayName>Contoso</DisplayName>
         <Description>Login with your Contoso account</Description>
         <Protocol Name="OpenIdConnect"/>
         <Metadata>
           <Item Key="METADATA">https://your-identity-provider.com/.well-known/openid-configuration</Item>
           <Item Key="client_id">00000000-0000-0000-0000-000000000000</Item>
           <Item Key="response_types">code</Item>
           <Item Key="scope">openid profile</Item>
           <Item Key="response_mode">form_post</Item>
           <Item Key="HttpBinding">POST</Item>
           <Item Key="UsePolicyInRedirectUri">false</Item>
         </Metadata>
         <!-- <CryptographicKeys>
           <Key Id="client_secret" StorageReferenceId="B2C_1A_ContosoSecret"/>
         </CryptographicKeys> -->
         <OutputClaims>
           <OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="oid"/>
           <OutputClaim ClaimTypeReferenceId="tenantId" PartnerClaimType="tid"/>
           <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
           <OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name" />
           <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
           <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
           <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true" />
           <OutputClaim ClaimTypeReferenceId="identityProvider" PartnerClaimType="iss" />
           <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="oid"/>
         </OutputClaims>
         <OutputClaimsTransformations>
           <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName"/>
           <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName"/>
           <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId"/>
           <OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId"/>
         </OutputClaimsTransformations>
         <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin"/>
       </TechnicalProfile>
     </TechnicalProfiles>
   </ClaimsProvider>
   

In the Metadata url, enter the URL of the OpenID Connect metadata document.

In the <Item Key="METADATA"> technical profile metadata, enter the URL of the OpenID Connect metadata document.

To add the client ID and client secret, copy these values from the identity provider and enter them into the corresponding fields.

In the <Item Key="client_id"> technical profile metadata, enter the client ID.

Create a policy key

If client secret is required, store the client secret that you previously recorded in your Azure AD B2C tenant.

1. Sign in to the Azure portal.

2. Make sure you're using the directory that contains your Azure AD B2C tenant. Select the Directory + subscription filter in the portal toolbar.

3. On the Portal settings | Directories + subscriptions page, find your Azure AD B2C directory in the Directory name list, and then select Switch.

4. Choose All services in the top-left corner of the Azure portal, and then search for and select Azure AD B2C.

5. On the Overview page, select Identity Experience Framework.

6. Select Policy Keys and then select Add.

7. For Options, choose Manual.

8. Enter a Name for the policy key. For example, ContosoSecret. The prefix B2C_1A_ is added automatically to the name of your key.

9. In Secret, enter your client secret that you previously recorded.

10. For Key usage, select Signature.

11. Click Create.

12. In the CryptographicKeys XML element, add the following element:

    <CryptographicKeys>
      <Key Id="client_secret" StorageReferenceId="B2C_1A_ContosoSecret"/>
    </CryptographicKeys>
    

In the Scope, enter the scopes from the identity provider. For example, openid profile.

In the <Item Key="scope"> technical profile metadata, enter the scopes from the identity provider. For example, openid profile.

In the Response type, select code, or id_token, according to your identity provider settings.

In the <Item Key="response_types"> technical profile metadata, select code, or id_token according to your identity provider settings.

In the Response mode, select form_post, or query, according to your identity provider settings.

In the <Item Key="response_mode"> technical profile metadata, select form_post, or query, according to your identity provider settings.

In the Domain hint, enter a domain name used in the domain hint.

In the <Domain>contoso.com</Domain> technical profile XML element, enter a domain name used in the domain hint. For example, contoso.com.

• User ID: Enter the claim that provides the unique identifier for the signed-in user.
• Display Name: Enter the claim that provides the display name or full name for the user.
• Given Name: Enter the claim that provides the first name of the user.
• Surname: Enter the claim that provides the last name of the user.
• Email: Enter the claim that provides the email address of the user.

The OutputClaims element contains a list of claims returned by your identity provider. Map the name of the claim defined in your policy to the name defined in the identity provider. Under the <OutputClaims> element, configure the PartnerClaimType attribute with the corresponding claim name as defined by your identity provider.

Add the identity provider to a user flow

1. In your Azure AD B2C tenant, select User flows.
2. Click the user flow that you want to add the identity provider.
3. Under the Social identity providers, select the identity provider you added. For example, Contoso.
4. Select Save.

Test your user flow

1. To test your policy, select Run user flow.
2. For Application, select the web application named testapp1 that you previously registered. The Reply URL should show https://jwt.ms.
3. Select the Run user flow button.
4. From the sign-up or sign-in page, select the identity provider you want to sign-in. For example, Contoso.

If the sign-in process is successful, your browser is redirected to https://jwt.ms, which displays the contents of the token returned by Azure AD B2C.

Add a user journey

At this point, the identity provider has been set up, but it's not yet available in any of the sign-in pages. If you don't have your own custom user journey, create a duplicate of an existing template user journey, otherwise continue to the next step.

1. Open the TrustFrameworkBase.xml file from the starter pack.
2. Find and copy the entire contents of the UserJourney element that includes Id="SignUpOrSignIn".
3. Open the TrustFrameworkExtensions.xml and find the UserJourneys element. If the element doesn't exist, add one.
4. Paste the entire content of the UserJourney element that you copied as a child of the UserJourneys element.
5. Rename the Id of the user journey. For example, Id="CustomSignUpSignIn".

Add the identity provider to a user journey

Now that you have a user journey, add the new identity provider to the user journey. You first add a sign-in button, then link the button to an action. The action is the technical profile you created earlier.

1. Find the orchestration step element that includes Type="CombinedSignInAndSignUp", or Type="ClaimsProviderSelection" in the user journey. It's usually the first orchestration step. The ClaimsProviderSelections element contains a list of identity providers that a user can sign in with. The order of the elements controls the order of the sign-in buttons presented to the user. Add a ClaimsProviderSelection XML element. Set the value of TargetClaimsExchangeId to a friendly name.

2. In the next orchestration step, add a ClaimsExchange element. Set the Id to the value of the target claims exchange Id. Update the value of TechnicalProfileReferenceId to the Id of the technical profile you created earlier.

The following XML demonstrates the first two orchestration steps of a user journey with the identity provider:

<OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
  <ClaimsProviderSelections>
    ...
    <ClaimsProviderSelection TargetClaimsExchangeId="ContosoExchange" />
  </ClaimsProviderSelections>
  ...
</OrchestrationStep>

<OrchestrationStep Order="2" Type="ClaimsExchange">
  ...
  <ClaimsExchanges>
    <ClaimsExchange Id="ContosoExchange" TechnicalProfileReferenceId="Contoso-OpenIdConnect" />
  </ClaimsExchanges>
</OrchestrationStep>

Configure the relying party policy

The relying party policy, for example SignUpSignIn.xml, specifies the user journey which Azure AD B2C will execute. Find the DefaultUserJourney element within relying party. Update the ReferenceId to match the user journey ID, in which you added the identity provider.

In the following example, for the CustomSignUpSignIn user journey, the ReferenceId is set to CustomSignUpSignIn:

<RelyingParty>
  <DefaultUserJourney ReferenceId="CustomSignUpSignIn" />
  ...
</RelyingParty>

Upload the custom policy

1. Sign in to the Azure portal.
2. Select the Directory + Subscription icon in the portal toolbar, and then select the directory that contains your Azure AD B2C tenant.
3. In the Azure portal, search for and select Azure AD B2C.
4. Under Policies, select Identity Experience Framework.
5. Select Upload Custom Policy, and then upload the two policy files that you changed, in the following order: the extension policy, for example TrustFrameworkExtensions.xml, then the relying party policy, such as SignUpSignIn.xml.

1. Select your relying party policy, for example B2C_1A_signup_signin.
2. For Application, select a web application that you previously registered. The Reply URL should show https://jwt.ms.
3. Select the Run now button.
4. From the sign-up or sign-in page, select Contoso to sign in with Google account.

If the sign-in process is successful, your browser is redirected to https://jwt.ms, which displays the contents of the token returned by Azure AD B2C.

Known Issues

• Azure AD B2C does not support JWE (JSON Web Encryption) for exchanging encrypted tokens with OpenID connect identity providers.

Next steps

Find more information see the OpenId Connect technical profile reference guide.