Azure Active Directory B2C

[reboottime]

Overview

Please note: this documentation was generated by Claude for quick reference. While helpful for understanding key concepts, specific details may vary or wrong.

• the workflow from user perspective
• Roughly learn Azure Active Directory B2C
• Azure B2C Authentication Flow: Policy XML to HTML Rendering

[reboottime]

The Workflow

From End User Perspective

More granular Level

[reboottime]

Azure Active Directory B2C

Azure Active Directory B2C (Azure AD B2C) is an identity management service that enables custom control of how customers sign up, sign in, and manage their profiles when using your applications. Even if user logins in using third party services, Azure still needs the user profiles data store.

Components

Identity Providers

• Social identity providers (Google, Facebook, Twitter)
• Enterprise identity providers (SAML, WS-Federation)
• Local accounts (email/password)

User Flows

Pre-built configurable policies for:

• Sign-up and sign-in
• Profile editing
• Password reset
• Progressive profiling
• Step-up authentication

Custom Policies

XML-based configurations for complex identity scenarios:

• Custom user journeys
• Integration with RESTful APIs
• Complex conditional access
• Trust framework modifications

Architecture

Policy Engine

• Executes user flows and custom policies
• Handles token issuance and validation
• Manages session state
• Orchestrates claims transformation

Token Service

• Issues JWT tokens
• Handles token encryption/decryption
• Manages token lifetime
• Implements token refresh logic

User Management

• Stores user profiles
• Handles password hashing
• Manages MFA registration
• Controls profile updates

Integration

Application Configuration

{
    "type": "web",
    "authentication": {
        "redirectUri": "https://myapp.com/auth",
        "clientId": "<application-id>",
        "responseType": "code",
        "scope": "openid profile"
    }
}

Identity Provider Setup

{
    "idpType": "Google",
    "clientId": "<google-client-id>",
    "clientSecret": "<google-client-secret>",
    "scopes": ["profile", "email"]
}

Security

• Threat protection
• Password complexity
• Brute force protection
• Session management
• Risk detection

[reboottime]

Azure B2C Authentication Flow: Policy XML to HTML Rendering

Core Concepts

Policy Structure

• TrustFrameworkPolicy is the root element
• BasePolicy defines inheritance from other policies
• UserJourneys define authentication flows
• RelyingParty contains configuration for the application

Authentication Flow

1. User accesses protected resource
2. Azure B2C injects UI elements into div#api
3. User clicks injected button
4. Policy orchestrates redirection to identity provider
5. Claims exchange occurs
6. JWT token issued upon successful authentication

Key Components

UserJourney

<UserJourney Id="JourneyName">
  <OrchestrationSteps>
    <OrchestrationStep Order="1" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="ExchangeId" TechnicalProfileReferenceId="IdP-OIDC" />
      </ClaimsExchanges>
    </OrchestrationStep>
  </OrchestrationSteps>
</UserJourney>


<RelyingParty>
  <DefaultUserJourney ReferenceId="JourneyName" />
  <TechnicalProfile Id="PolicyProfile">
    <OutputClaims>
      <OutputClaim ClaimTypeReferenceId="claim1" />
    </OutputClaims>
  </TechnicalProfile>
</RelyingParty>